Remote Access and Connections CSE Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A security administrator has deployed a bastion host and wants to ensure that only the bastion can SSH to the internal Linux VMs. The VMs are in the same VNet as the bastion. Which NSG rule should be applied to the VMs' subnet?

   • AAllow inbound SSH only from the bastion host's private IP address.
   • BAllow inbound SSH from any IP address in the VNet.
   • CAllow inbound SSH from the company's public IP range.
   • DDeny all inbound SSH traffic.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   An organization has deployed a bastion host for administrative access. The security team needs to detect unauthorized access attempts and ensure that all administrative sessions are logged for later review. Which combination of actions should be taken?

   • AConfigure the bastion to allow all traffic and rely on the cloud provider's default monitoring.
   • BEnable logging only on the VMs, not on the bastion.
   • CDisable logging on the bastion to reduce performance overhead.
   • DEnable diagnostic logging on the bastion host, stream logs to a central SIEM, and configure alerts for failed login attempts.
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   Which configuration is typical for a bastion host to ensure it is secure?

   • AIt is placed on a private subnet with no network access
   • BIt is placed on a private subnet with direct access to all VMs
   • CIt is placed on the public internet with all ports open
   • DIt is placed in a DMZ or public subnet with restricted inbound access
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A company has a remote-access VPN that uses IAM for authentication. The security team wants to enforce MFA for all VPN users, but some legacy VPN clients do not support MFA prompts. The team needs to ensure that all users are protected without disrupting access for those with legacy clients. Which approach should be taken?

   • ADisable MFA for all users to ensure compatibility.
   • BRequire MFA only for users accessing sensitive resources.
   • CExempt legacy VPN clients from MFA to avoid disruption.
   • DUse a conditional access policy that requires MFA for all VPN users, and update or replace legacy VPN clients that do not support MFA.
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A security architect is designing a bastion host solution for a large environment with hundreds of VMs. The bastion will be the only entry point for SSH and RDP. The architect needs to ensure that the bastion itself is highly available and that all administrative sessions are recorded. Which design should be implemented?

   • AUse a VPN gateway as the bastion and rely on its logs.
   • BDeploy a single bastion host with a large instance type to handle the load.
   • CDeploy two bastion hosts in different availability zones, place them behind a load balancer, and enable session recording on both.
   • DDeploy multiple bastion hosts but do not enable session recording to reduce complexity.
   Reveal Solution Discussion Select an answer first