What is a bastion host and how does it enhance secure remote access to cloud resources?

• A. A bastion host is a general-purpose VM used for running workloads in the public subnet.
• B. A bastion host eliminates need for access controls.
• C. A bastion host is a firewall appliance that blocks all access.
• D. A bastion host is a hardened jump server that provides controlled access to private networks, reducing exposure of direct access.

Answer: (D)

A bastion host is a hardened jump server that provides controlled access to private networks, reducing exposure of direct access. In practice, it sits in a public-facing subnet and administrators first authenticate to this single, tightly secured machine. From the bastion, they connect to the private resources (like internal VMs or services) in a controlled way, typically over SSH or RDP, with strict access controls, MFA, and detailed session logging.

This pattern centralizes and strengthens remote management: it limits which systems can be reached from the internet, consolidates authentication and auditing, and makes it easier to enforce least-privilege access and quick revocation. It’s not a general-purpose VM for workloads, it’s not a firewall that blocks all access, and it doesn’t remove the need for access controls. Instead, it serves as a dedicated, auditable gatekeeper for accessing private cloud resources.