ISC2 Certified Cloud Security Professional (CCSP) Practice Question

Your company runs several Linux-based application servers in a public cloud VPC. The instances reside in a private subnet that has no Internet gateway. Operations engineers working from the corporate network (a fixed /29 public address block) require occasional SSH access for troubleshooting. Corporate policy prohibits exposing the application servers directly to the Internet. From a network-security standpoint, which design change BEST provides the required access while preserving least privilege and minimizing the public attack surface?

Configure an Internet-facing load balancer to forward TCP/22 to the private instances and restrict the listener to the corporate /29.
Place a small, hardened bastion host in a public subnet, allow SSH to it only from the corporate /29, and permit the private instances to accept SSH solely from the bastion's security group.
Keep the servers in the private subnet, enable host-based firewalls, and allow SSH from 0.0.0.0/0 so administrators can reach them from anywhere.
Assign public IP addresses to every application server and add a security-group rule that allows TCP/22 only from the corporate /29.

Report Issue

Answer Description

The common and recommended pattern is to deploy a hardened bastion (jump) host in a small public subnet and give it the only public IP address. The security group on the bastion permits inbound TCP/22 solely from the corporate /29. The application servers keep their private addresses; their security group allows SSH only from the bastion's security group, so no Internet host can reach them directly. Opening port 22 on every server (even if restricted by IP) or through a load balancer markedly increases the number of publicly reachable endpoints. Allowing 0.0.0.0/0 or relying only on host firewalls conflicts with the stated policy and expands exposure. While out-of-band tools like SSM or similar services can remove the need for SSH, that option was not listed; a VPN alone without a jump host would still require routing changes and additional management complexity.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.