Which device facilitates separation of duties in a security architecture?

Which device facilitates separation of duties in a security architecture?

• A. Firewall
• B. Router
• C. Bastion Host
• D. IDS

Answer: (C)

Separation of duties means dividing responsibilities so that no single system or person has unchecked control over privileged actions, improving accountability and reducing the risk of misuse. A bastion host fits this role because it is a hardened gateway placed at the security boundary that centralizes and controls privileged access to sensitive systems. By funneling administrator connections through this dedicated, tightly secured machine, authentication, authorization, and auditing for admin tasks are enforced in one controlled point. This isolates privileged management from regular network traffic and hosts, ensuring that critical operations are performed through a monitored, auditable interface. The other devices—firewalls, routers, and intrusion detection systems—serve important network protection functions, but they do not by themselves establish the same controlled, auditable boundary for privileged access.

Separation of duties means dividing responsibilities so that no single system or person has unchecked control over privileged actions, improving accountability and reducing the risk of misuse. A bastion host fits this role because it is a hardened gateway placed at the security boundary that centralizes and controls privileged access to sensitive systems. By funneling administrator connections through this dedicated, tightly secured machine, authentication, authorization, and auditing for admin tasks are enforced in one controlled point. This isolates privileged management from regular network traffic and hosts, ensuring that critical operations are performed through a monitored, auditable interface. The other devices—firewalls, routers, and intrusion detection systems—serve important network protection functions, but they do not by themselves establish the same controlled, auditable boundary for privileged access.