Exam CCSP topic 1 question 315 discussion

A bastion host is a hardened system that is specifically designed to be exposed to the public internet while minimizing security risks. It is configured to perform only essential functions, reducing its attack surface. Bastion hosts are commonly used for secure remote access (e.g., SSH jump servers) or as intermediary systems for accessing internal networks securely. Why Not the Others? A. Firewall → Firewalls control traffic flow and enforce security policies but do not function as publicly exposed operational systems. B. Proxy → Proxies act as intermediaries for network requests but are not standalone hardened systems for direct exposure. C. Honeypot → A honeypot is a decoy system used to attract and analyze attacks, not a secure public-facing system for legitimate operations.

D. Bastion A bastion host is a secure system that is exposed to the public Internet and designed to withstand attacks. It is configured to perform only the desired operations and is hardened to resist compromise. Bastion hosts are typically used as gateways or intermediaries to provide access to internal network resources while minimizing the security risks associated with direct exposure to the Internet.

Silly question as you can argue for both A & D, but I think in the context of CCSP, I would go for D

Wrong! Thats the Job of firewall

D. Bastion