Which of the following is NOT a recommended best practice for securing Terminal Services and...

Require TLS authentication and data encryption whenever possible.

Make sure to allow all TCP 3389 traffic through the external firewall.

Group Policy should be used to lock down the virtual desktops of thin-client users.

Consider using IPSec or a VPN in addition to the RDP encryption if you are concerned about future RDP vulnerabilities.