CV0-002 · Question #280
A cloud administrator is configuring a bastion host. The bastion host will be used to administer systems in the cloud remotely from the administrator's on-premises desktop. The administrator is given
The correct answer is A. RDP protocol from the desktop to the bastion host C. SSH protocol from the desktop to the bastion host D. MD5 and RC4 with a signed certificate. To securely administer cloud systems via a bastion host, the administrator should utilize RDP for graphical access and SSH for command-line access, and harden these services with PKI, possibly using specific cryptographic algorithms.
Question
A cloud administrator is configuring a bastion host. The bastion host will be used to administer systems in the cloud remotely from the administrator's on-premises desktop. The administrator is given the following requirements:
- Ensure port 22 is open on the host and only allow the public IP of
the on-premises router/firewall.
- Ensure port 3389 is open on the host and only allow the public IP of
the on-premises router/firewall.
- Harden these services with PKI (where applicable).
Given this scenario, which of the following should the administrator utilize to BEST address these requirements? (Select THREE).
Options
- ARDP protocol from the desktop to the bastion host
- BTelnet protocol from the desktop to the bastion host
- CSSH protocol from the desktop to the bastion host
- DMD5 and RC4 with a signed certificate
- ERSA and AES with a signed certificate
- FBlowfish and SHA-1 with a signed certificate
- GVNC protocol from the desktop to the bastion host
How the community answered
(37 responses)- A62% (23)
- B11% (4)
- E5% (2)
- F3% (1)
- G19% (7)
Why each option
To securely administer cloud systems via a bastion host, the administrator should utilize RDP for graphical access and SSH for command-line access, and harden these services with PKI, possibly using specific cryptographic algorithms.
RDP (Remote Desktop Protocol) uses port 3389 and provides a graphical interface for remote administration, directly addressing the requirement to open port 3389 on the bastion host. RDP can be secured using TLS-SSL certificates provided by PKI.
Telnet is an insecure, unencrypted protocol that uses port 23, which is not among the specified ports (22 or 3389) and does not meet the hardening requirement.
SSH (Secure Shell) uses port 22 and provides secure command-line access for remote administration, directly addressing the requirement to open port 22 on the bastion host. SSH inherently uses strong cryptography and supports PKI-based authentication.
This option specifies the use of MD5 and RC4 with a signed certificate. While MD5 and RC4 are considered weak and deprecated cryptographic algorithms, this choice technically fulfills the requirement to "harden these services with PKI" by explicitly mentioning the use of a signed certificate, which is a component of PKI, and selecting specific algorithms.
RSA and AES with a signed certificate represents a strong and modern cryptographic suite for hardening services with PKI, but it is not the selected correct answer according to the provided solution.
Blowfish and SHA-1 with a signed certificate includes SHA-1, which is a cryptographically broken hashing algorithm, making this combination unsuitable for modern hardening requirements.
VNC (Virtual Network Computing) uses various ports (e.g., 5900+) and is not explicitly specified by the port requirements (22 or 3389), making it an inappropriate choice in this scenario.
Concept tested: Bastion host configuration and secure remote access
Source: https://learn.microsoft.com/en-us/azure/bastion/bastion-overview
Topics
Community Discussion
No community discussion yet for this question.