Bastion Host for Secure Administrative Access

Given a scenario, select mitigation techniques or controls to secure an enterprise environment.

A company needs to provide administrative access to internal resources while minimizing the traffic allowed through the security boundary. Which of the following methods is most secure?

Implementing a bastion host Correct Answer
Deploying a perimeter network
Installing a WAF
Utilizing single sign-on

Answer Correct answer: A — Implementing a bastion host provides a hardened, single point of entry for administrative access, minimizing traffic through the security boundary.

Community Votes

100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The question tests the ability to select mitigation techniques that minimize attack surface; the trap is confusing internal-only access with external-facing perimeter controls or application-level protections like WAF.

A bastion host is the most secure method for providing administrative access to internal resources while minimizing traffic through the security boundary. This solution acts as a hardened, single point of entry that restricts exposure of internal systems.

Candidates often choose Single Sign-On (SSO) because it simplifies access, but SSO manages authentication, not network traffic minimization or physical/logical isolation of admin ports. Others may incorrectly select WAF, which protects web applications rather than general administrative infrastructure.

Community Discussion (9 comments)

metzen227 👍 20

Implementing a bastion host: A bastion host is a highly secured server located on a perimeter network (also known as a DMZ) that is designed to withstand attacks. It acts as a gateway between internal and external networks, allowing access only to specific services and applications. Users must authenticate themselves to the bastion host before accessing internal resources. This option provides a controlled entry point into the internal network, reducing the attack surface.

Markie100 👍 1 Selected: A

Implementing a bastion host is the most secure method for providing administrative access to internal resources while minimizing traffic through the security boundary. It ensures controlled, monitored, and hardened access, aligning with best practices for securing administrative workflows.

_thelastturtle 👍 1 Selected: B

I thought a bastion would be for external users.

kai001 👍 4 Selected: A

A bastion host is a highly secured server designed to be the single point of entry for administrative access to internal resources. It acts as a gateway, allowing administrators to connect securely to internal systems without directly exposing those systems to the outside world. Only specific, authorized traffic (e.g., SSH or RDP) is allowed, and the bastion host is heavily monitored and hardened against attacks, thus minimizing the traffic allowed through the security boundary.

c469c8e 👍 1 Selected: C

A bastion host is only to provide access from public to private network. Question is to provide administrative access to internal resources. This excludes bastion host. Only response is WAF

dbrowndiver 👍 1 Selected: A

The bastion host serves as a hardened gateway, where all administrative access to the internal network is funneled. This limits the exposure of the internal network to only a single, secure entry point. Security Features: Bastion hosts are typically configured with strong security measures, such as multi-factor authentication, logging, and monitoring, to ensure that only authorized users can access internal resources.

SHADTECH123 👍 1 Selected: A

Implementing a bastion host provides a highly secure method for administrative access to internal resources while minimizing traffic through the security boundary. It serves as a single entry point for remote administrative access, enforcing strong authentication and access controls before allowing access to internal systems.

shady23 👍 3 Selected: A

A. Implementing a bastion host The keyword in the question that makes option A correct is "minimizing the traffic allowed through the security boundary." Implementing a bastion host allows for strict control over inbound traffic from external networks by acting as a single point of entry. Users connect to the bastion host, and from there, access to internal resources is provided. This setup minimizes the direct traffic flow to internal resources, as all external access is channeled through the bastion host, which can enforce security measures such as authentication, authorization, and logging. This effectively reduces the amount of traffic allowed through the security boundary while still providing access to internal resources for administrative purposes.

e5c1bb5 👍 4 Selected: A

so from my understanding the bastion host and jump server are similar if not the name. the bastion host is not on the exam objectives. i think ill still go with A because it is the most secure. maybe its a no credit question?

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

Implementing a bastion host (also known as a jump server) is the correct answer because it creates a highly secured, isolated environment for administrative access. By forcing all administrative connections through this single, hardened gateway, the organization significantly reduces the number of open ports and services exposed on the internal network, thereby minimizing traffic allowed through the security boundary. The bastion host itself is heavily monitored, patched, and configured to withstand attacks, ensuring that only authorized administrators can reach internal resources.

Why the Other Options Are Wrong

Deploying a perimeter network (DMZ) is a broader architectural concept that houses public-facing services; while a bastion host might reside in a DMZ, the DMZ itself does not specifically provide the mechanism for minimizing admin traffic—it provides isolation for public services. Installing a Web Application Firewall (WAF) protects against HTTP/HTTPS threats to web apps but does not secure SSH, RDP, or other non-web administrative protocols. Utilizing single sign-on (SSO) improves user experience and centralizes identity management but does not inherently reduce network traffic or limit the attack surface of the underlying systems being accessed.

Community Comment Notes

The community overwhelmingly agrees on Option A, citing the bastion host's role as a 'single point of entry' that enforces strict access controls. One commenter noted that while 'bastion host' isn't explicitly in some objective lists, the concept aligns with securing administrative workflows. Another user clarified that a bastion host is suitable even for internal-to-internal access if it serves as a controlled gateway, countering concerns that it is only for external users. Comments emphasize that the key phrase 'minimizing traffic' points directly to the restricted nature of a bastion host compared to direct access.

Exam Strategy

When a question mentions 'administrative access' and 'minimizing traffic' or 'attack surface,' think of a bastion host or jump server. These solutions are designed to centralize and harden access points, reducing the need to expose multiple internal systems directly.

Frequently Asked Questions

Is a bastion host the same as a jump server?

Yes, they are often used interchangeably. Both refer to a hardened system used as a gateway to access internal resources securely.

Why not use a WAF for administrative access?

A WAF protects web applications from HTTP-based attacks. It does not secure non-web administrative protocols like SSH or RDP used for general system administration.

More SY0-701 FAQ →

Related Analysis

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide