Which component is designed to protect network resources and typically handles traffic between public and private interfaces?

Which component is designed to protect network resources and typically handles traffic between public and private interfaces?

• A. Bastion Host
• B. Screened Subnet
• C. Multi-homed Firewall
• D. VPN Gateway

Answer: (A)

A bastion host is a hardened system placed at the boundary between untrusted and trusted networks. It serves as the gatekeeper for resources behind it, exposing only the necessary services to the outside and enforcing strict access controls, logging, and monitoring. Because it sits at the edge and must withstand attacks, it’s built with a minimal attack surface and robust security measures, making it the primary component designed to protect network resources and handle traffic that flows between public and private interfaces. Other options describe broader architectures or different functions: a screened subnet is a DMZ design, not a single protective host; a multi-homed firewall is a firewall device with multiple network connections; a VPN gateway provides encrypted remote access rather than directly managing traffic between public and private networks at a hardened host level.

A bastion host is a hardened system placed at the boundary between untrusted and trusted networks. It serves as the gatekeeper for resources behind it, exposing only the necessary services to the outside and enforcing strict access controls, logging, and monitoring. Because it sits at the edge and must withstand attacks, it’s built with a minimal attack surface and robust security measures, making it the primary component designed to protect network resources and handle traffic that flows between public and private interfaces.

Other options describe broader architectures or different functions: a screened subnet is a DMZ design, not a single protective host; a multi-homed firewall is a firewall device with multiple network connections; a VPN gateway provides encrypted remote access rather than directly managing traffic between public and private networks at a hardened host level.