County network admins still share a jump-host password over cleartext chat to reach core routers. Which change best implements secure remote administrative access?
Select an answer to reveal the explanation.
Short Explanation
Think of the jump host like the locked front desk for the network closet—handing one shared password around in plain chat is like taping the master key to the break-room fridge. Give each admin their own MFA login through a hardened bastion or privileged gateway, and record the session. Shared cleartext secrets and silent jump hosts are the opposite of secure remote admin.
Full Explanation
Secure remote administrative access for county network infrastructure depends on unique identities, strong authentication, and a controlled jump path—not a shared cleartext password passed through informal chat. A hardened bastion host or privileged access gateway terminates admin sessions in a monitored chokepoint, enforces multifactor authentication per administrator, and can record sessions for accountability and forensic review. Individual MFA-backed credentials restore nonrepudiation: each change on a core router can be attributed to a named operator rather than an anonymous shared secret. Session recording and detailed logging support continuous monitoring and incident investigation when privileged remote work goes wrong.
Moving the same shared password into a city-branded emoji bot or another informal channel does not remediate exposure; the credential remains collective, cleartext-adjacent in human workflows, and impossible to revoke cleanly for one person without disrupting everyone. Publishing the jump password on the intranet homepage maximizes unauthorized reuse and treats confidentiality as optional. Disabling logging on the jump host to “reduce SIEM clutter” removes the evidence trail that privileged-access governance requires and blinds responders to brute-force or misuse attempts.
Exam caveat: CISSP Communication and Network Security and IAM themes converge here—secure channels and privileged access management both reject shared secrets and unmonitored remote admin. Operational check: inventory jump/bastion accounts for uniqueness and MFA, confirm session recording or equivalent logging is on, revoke any chat-distributed shared passwords, and verify SIEM still receives failed and successful privileged logins from the gateway.