What does VNC stand for?
VNC stands for Virtual Network Computing. A remote desktop protocol. When it is exposed or weakly configured, it is a remote access threat vector.
VNC is a way to see and control another computer's screen over the network. It works at the level of the picture: the server sends the pixels of its display and the viewer sends back keystrokes and mouse movements, using the Remote Framebuffer protocol, by default on TCP port 5900. Because it deals only in pixels and input, it runs on almost any operating system, and it shows the same screen that a person sitting at the machine sees. Its classic password check is weak. The protocol's own specification says it is not intended for use on untrusted networks, so VNC is normally run through SSH or a VPN.
VNC in practice: an example
A help-desk technician needs to see exactly what a Linux user sees in order to explain a menu. With VNC the two share one screen, and the user watches the pointer move. The connection is not opened to the internet: the technician first connects to the company VPN, and the VNC server accepts connections only from the internal network.
What VNC is confused with
VNC vs RDP: what is the difference?
RDP is Microsoft's protocol and gives each user a Windows session of their own, on port 3389. VNC shares the screen that is already displayed, on port 5900, and is independent of the operating system. What RDP stands for
VNC vs SSH: what is the difference?
SSH gives an encrypted command line and can carry other traffic inside it. VNC gives a graphical desktop and is often run through an SSH tunnel for protection. What SSH stands for
Which exams cover VNC?
VNC is on the official CompTIA acronym list for two of the four exams covered here.
- Security+ SY0-801: 2.3 (Threats, Vulnerabilities, and Attacks).
- A+ 220-1201 and 220-1202: 220-1202 4.0 (Operational Procedures). Listed there as “Virtual Network Computer”.
Each number is a CompTIA exam objective and the name in brackets is its domain. The exam puts the term in a scenario; it does not ask you to recite the expansion.
Check yourself: two practice questions
Written by CertSprint for this page. They are not taken from any exam.
1. A vulnerability scan finds TCP 5900 open to the internet on a workstation. What is exposed?
- A VNC remote desktop service
- A mail server
- A DNS resolver
- A time server
Show the answer
A. A VNC remote desktop service. Port 5900 is the default for the Remote Framebuffer protocol that VNC uses. Remote control software reachable from the internet is a common way in for attackers.
2. Which is the appropriate way to give an administrator VNC access to a server from home?
- Through a VPN or SSH tunnel, with the VNC port closed to the internet
- By forwarding port 5900 from the internet to the server
- By removing the VNC password
- By sending the session over Telnet
Show the answer
A. Through a VPN or SSH tunnel, with the VNC port closed to the internet. The protocol's built-in authentication is weak, so it should not face the internet. A tunnel puts strong authentication and encryption in front of it.
Sources: RFC 6143: The Remote Framebuffer Protocol; NIST SP 800-46 Rev. 2, Guide to Enterprise Telework, Remote Access, and BYOD Security. The acronym and its expansion come from CompTIA's official acronym lists, linked from each exam glossary above. The explanation, example and questions are CertSprint's own, checked against these sources on 12 November 2026.