SSH vs. bastion host for closed network management

N10-009 By islever Editorial Last updated

Explain common networking ports, protocols, services, and traffic types. Compare and contrast network access and management methods.

Short answer

C Use SSH to securely manage a router or switch on a closed network, because it encrypts the remote CLI session while a bastion host is only a hardened jump point.

Question

Which of the following would a network administrator most likely use to securely manage a network device on a closed network?
  1. Bastion host
  2. Remote desktop
  3. SSH Correct Answer
  4. Split-tunnel VPN

Key Takeaways

The question tests the line between a secure management protocol (SSH) and an access host (bastion), with the main trap being to choose the hardened gateway instead of the encrypted session used to manage the device.

Securely managing a router or switch on a closed network calls for SSH, the encrypted remote CLI protocol, rather than a bastion host, RDP, or a split-tunnel VPN. This page explains why option C is the correct answer.

Common mistake: Choosing A, bastion host, is the common error: it is a hardened jump server that may provide an access path, but it is not the encrypted protocol used to manage the network device itself.

Expert Analysis

Protocol vs. access host The stem asks what the administrator would use to securely manage a network device—typically a router or switch—on a closed network. That points to the management protocol, not to an intermediate access machine. SSH (C) encrypts the remote command-line session to the device, providing authentication and confidentiality, and it is the standard secure management method for network gear. On a closed network, no external path needs to be crossed, so the secure channel is simply SSH from an administrative workstation to the device.

Why the bastion-host answer is tempting Option A, a bastion host, is the main distractor. It is a hardened host placed on a perimeter or management segment to serve as a controlled jump point; administrators may then run SSH or RDP through it. A commenter accurately describes it as a specialized hardened computer that provides a secure gateway. But that is an access architecture, not the tool used to manage the device itself. If the question asked how to reach a protected management segment from an untrusted network, A could fit; here the network is already closed.

Eliminating the remaining options RDP (B) is a Windows remote-desktop protocol, not the usual secure CLI for routers and switches. Split-tunnel VPN (D) is a remote-access routing choice that sends only some traffic through a VPN; it solves a different problem and is irrelevant to an isolated, closed network. A comment dismissing the VPN option is right for that reason.

Conclusion The precise boundary is protocol versus access host: SSH is the secure management protocol; a bastion host is an optional hardened gateway. Therefore C is correct.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When a question asks for a tool to "securely manage" a network device, map it to a management protocol first: SSH for encrypted CLI, HTTPS for web UI, RDP for Windows GUI. Treat bastion hosts and VPNs as access-path components that may support management, not the protocol itself, unless the stem explicitly asks how to reach an isolated segment. Eliminate options that solve a different problem—RDP is GUI and VPN is remote connectivity—then pick the protocol that encrypts the session to the device.

Frequently Asked Questions

Why is SSH a better answer than a bastion host for managing a closed network device?

SSH is the encrypted management protocol used to administer the router or switch itself. A bastion host is a hardened jump server that may carry that SSH session, but it is an access path rather than the management tool asked for.

Does managing devices on a closed network require a split-tunnel VPN?

No. A closed or isolated network has no untrusted external path to protect with a VPN; split tunneling only controls which traffic enters a VPN tunnel during remote access.

Is SSH only used for Linux servers?

No. SSH is a standards-based protocol supported by routers, switches, firewalls, and other network devices for encrypted CLI management, regardless of the underlying operating system.

More N10-009 FAQ →

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. jb255 👍 2 Answered C
    No it isn't dude. Read the question again, it's got nothing to do with VPNs.
  2. johnjohnsmithsmith 👍 2
    bot comment 100%
  3. test7n1 👍 2 Answered C
    C is the answer
  4. ERB14 👍 1 Answered A
    Bastion host: A bastion host is a specialized, hardened computer specifically designed and configured to withstand attacks. It typically resides on a network perimeter or a secured management segment to provide a controlled, secure gateway (such as via SSH or RDP) for administrators to access and manage network devices on an isolated or closed network.
  5. 67bdb19 👍 1 Answered D
    D is the textbook answer for this situation.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Why does a moved 2.4GHz WAP cause intermittent laptop issues?

S-grade

How to Reduce Network Congestion and Improve Performance?

S-grade

Why did the telephone system lose connection with a working console and module access?

S-grade

What is the transport layer transmission format for connectionless communication?

S-grade

Practice All N10-009 Questions

Access 100 questions with complete answers and detailed explanations.

View Full N10-009 Practice Test →

← Back to N10-009 Study Guide