Which term describes a computer system designed and configured to protect network resources from attacks?

Which term describes a computer system designed and configured to protect network resources from attacks?

• A. Demilitarized Zone (DMZ)
• B. Firewall
• C. Bastion Host
• D. Screened Subnet

Answer: (C)

A Bastion Host is a system that has been deliberately hardened and is exposed to an untrusted network to withstand attacks while providing tightly controlled access to protected resources. This setup is designed specifically for defense at the boundary, acting as a single, robust point through which external access is allowed and monitored. The idea is to minimize services, apply strong access controls, and keep thorough logging so that any attack surface is reduced and any intrusions can be detected quickly. This fits the description in the question because the emphasis is on a computer system that is purpose-built to protect network resources from attacks, rather than on a broader network segment or a generic traffic-filtering device. A firewall, in contrast, is primarily about filtering traffic between networks. A DMZ is a network zone, not a single system. A screened subnet describes an architectural pattern involving firewalls around a DMZ.

A Bastion Host is a system that has been deliberately hardened and is exposed to an untrusted network to withstand attacks while providing tightly controlled access to protected resources. This setup is designed specifically for defense at the boundary, acting as a single, robust point through which external access is allowed and monitored. The idea is to minimize services, apply strong access controls, and keep thorough logging so that any attack surface is reduced and any intrusions can be detected quickly.

This fits the description in the question because the emphasis is on a computer system that is purpose-built to protect network resources from attacks, rather than on a broader network segment or a generic traffic-filtering device. A firewall, in contrast, is primarily about filtering traffic between networks. A DMZ is a network zone, not a single system. A screened subnet describes an architectural pattern involving firewalls around a DMZ.