An information technology (IT) employee who travels frequently to various countries remotely connects to an organization's resources to troubleshoot problems. Which of the following solutions BEST ser

A traveling employee connecting from multiple countries will use dynamic, frequently changing IP addresses, making static IP-based firewall rules impractical, unmanageable, and insecure as they would require constant updates or overly broad rules.

Third-party screen sharing solutions hosted on public websites introduce uncontrolled attack surfaces, may lack enterprise-grade encryption or auditing, and represent a shadow IT risk that bypasses organizational security policies.

DDNS maps dynamic IPs to a hostname but does not itself initiate or secure a VPN; without proper endpoint authentication and access controls, a DDNS-initiated VPN still lacks the hardened access control and MFA enforcement needed to be the best secure solution.

A bastion host deployed in the DMZ acts as a hardened, single point of entry for remote administrative access, isolating internal resources from direct external exposure. Requiring MFA adds a critical second layer of authentication, ensuring that even compromised credentials alone cannot grant access. This architecture is vendor-agnostic, location-independent, and aligns with zero-trust and defense-in-depth security principles for traveling users connecting from dynamic IPs worldwide.