CV0-003 · Question #280
A cloud administrator is configuring a bastion host. The bastion host will be used to administer systems in the cloud remotely from the administrator's on-premises desktop. The administrator is…
The correct answer is A. RDP protocol from the desktop to the bastion host C. SSH protocol from the desktop to the bastion host D. MD5 and RC4 with a signed certificate. A bastion host supporting remote administration must have both SSH (port 22) and RDP (port 3389) enabled, with certificate-based PKI hardening to secure access from the on-premises network.
Question
A cloud administrator is configuring a bastion host. The bastion host will be used to administer systems in the cloud remotely from the administrator's on-premises desktop. The administrator is given the following requirements:
- Ensure port 22 is open on the host and only allow the public IP of
the on-premises router/firewall.
- Ensure port 3389 is open on the host and only allow the public IP of
the on-premises router/firewall.
- Harden these services with PKI (where applicable).
Given this scenario, which of the following should the administrator utilize to BEST address these requirements? (Select THREE).
Options
- ARDP protocol from the desktop to the bastion host
- BTelnet protocol from the desktop to the bastion host
- CSSH protocol from the desktop to the bastion host
- DMD5 and RC4 with a signed certificate
- ERSA and AES with a signed certificate
- FBlowfish and SHA-1 with a signed certificate
- GVNC protocol from the desktop to the bastion host
How the community answered
(27 responses)- A74% (20)
- B7% (2)
- F15% (4)
- G4% (1)
Why each option
A bastion host supporting remote administration must have both SSH (port 22) and RDP (port 3389) enabled, with certificate-based PKI hardening to secure access from the on-premises network.
RDP operates on port 3389 and provides encrypted graphical remote desktop access to Windows-based systems, directly satisfying the requirement to open port 3389 on the bastion host for administrative sessions.
Telnet transmits all data including credentials in plaintext with no encryption, making it fundamentally incompatible with a hardened bastion host.
SSH operates on port 22 and provides encrypted remote shell access with support for PKI-based key authentication, directly satisfying the requirement to open port 22 on the bastion host for secure command-line administration.
The signed certificate component of this option satisfies the PKI hardening requirement by enabling certificate-based authentication on the bastion host services; the signed certificate establishes trust and encrypts administrative sessions.
RSA and AES are stronger modern algorithms than MD5 and RC4, but this option is not selected because the scenario's PKI hardening requirement is addressed through the signed certificate in option D.
Blowfish is a legacy block cipher and SHA-1 is a deprecated hash algorithm that no longer meets modern cryptographic standards and would not constitute adequate PKI hardening.
VNC operates on different ports such as 5900 and is not associated with port 22 or port 3389, so it does not satisfy either of the stated port requirements for the bastion host.
Concept tested: Bastion host remote access protocols and PKI certificate hardening
Source: https://learn.microsoft.com/en-us/azure/bastion/bastion-overview
Topics
Community Discussion
No community discussion yet for this question.