Which of the following is allowed by a company to be addressed directly from the public network and is hardened to screen the rest of its network from security exposure?

An intrusion detection system (IDS) monitors and alerts on suspicious traffic but is not itself publicly addressed as an entry point, nor is it hardened to serve as a network gateway.

A system configured with sender reputation is an email security feature that evaluates the trustworthiness of mail senders; it is not a general-purpose publicly accessible hardened host.

A bastion host is deliberately exposed to the public internet and hardened by removing unnecessary services, applying strict access controls, and intensive auditing to minimize its attack surface. It acts as a gateway that shields the internal network, so any attacker who breaches the perimeter must go through it first. Its design prioritizes resilience because it is expected to withstand direct attacks from the public network.

Exchange ActiveSync is a Microsoft protocol that synchronizes email and calendar data to mobile devices; it is an application protocol, not a hardened host architecture.