Linux engineers SSH to jump targets and Windows admins use RDP for city servers. What secure access practice should apply?
Select an answer to reveal the explanation.
Short Explanation
SSH and RDP are master keys—do not hang them on the front gate facing the whole internet. Park them behind a bastion, VPN, or similar controlled path so only the right admins get through.
Full Explanation
Administrative protocols such as SSH and RDP should not be exposed to the entire internet. Engineers should reach city servers through controlled paths—bastion/jump hosts, VPN, or zero-trust brokers—so brute-force and exploit traffic never hit management ports directly. Reducing public exposure of admin protocols is foundational secure remote access for municipal infrastructure.
Publishing SSH and RDP on 0.0.0.0/0 for convenience is a top cloud misconfiguration. Disabling encryption on SSH and RDP to improve throughput destroys confidentiality and integrity. Replacing all passwords with the string "password" guarantees compromise.
Exam caveat: prefer private admin planes plus bastion/VPN/ZTA; security groups/NACLs should deny world access to 22/3389. Session recording and MFA on the broker add defense in depth.
Operational check: inventory public admin ports, remove 0.0.0.0/0 rules, place access behind bastion or VPN, test admin workflows for Linux and Windows teams, and alert on any new public management exposure. Include this check in the city’s continuous cloud security scorecard.
Continuously query public IP inventory for listeners on 22 and 3389 across city subscriptions, auto-opening tickets when world-open admin ports reappear after “temporary” troubleshooting.