Private admin subnets hold management interfaces with no direct public IPs. How should engineers reach those hosts?
Select an answer to reveal the explanation.
Short Explanation
A bastion is the locked lobby before the private offices. Admins land on the hardened jump host first, then hop inside—no public IPs sprayed onto every management NIC.
Full Explanation
Private admin subnets without direct public IPs need a controlled entry point. A hardened bastion (jump) host provides that choke point so engineers can reach management interfaces without assigning public IPs to every admin system. Bastions concentrate monitoring, MFA, and patching for municipal privileged access paths.
Assigning public IPs to every admin interface and opening all ports defeats private subnet design. Bridging the admin subnet to guest Wi-Fi at city hall exposes management planes to inappropriate networks. Emailing configuration files to personal accounts instead of logging in is neither administration nor secure.
Exam caveat: bastion hosts must themselves be hardened, tightly firewalled, and audited; they are not a reason to skip MFA or least privilege on targets. Some designs replace classic bastions with VPN or zero-trust session brokers—same conceptual "controlled entry."
Operational check: deploy a patched bastion in a public or transit subnet with allowlists, require MFA, permit SSH/RDP only from bastion to admin NICs, log sessions, and prohibit direct public admin IPs. Review bastion access lists when staff change roles.
Pair the bastion with just-in-time access or short-lived certificates where feasible, so private admin subnet entry for municipal engineers remains controlled even if a bastion account is later mistyped into a broader group.