AWS (Amazon Web Services) Certification Practice Exam

What is the primary function of a Bastion Host in AWS?

1. It stores large amounts of data securely

2. It allows access to a private subnet via the internet

3. It serves as a content delivery network

4. It manages user permissions across services

The correct answer is: It allows access to a private subnet via the internet

A Bastion Host in AWS serves as a secure gateway for accessing instances in a private subnet, allowing connections from the internet to systems that would otherwise be inaccessible due to network restrictions. The primary function of a Bastion Host is to facilitate secure administrative access to instances located in a private subnet without exposing them directly to the public internet. This often takes the form of SSH or RDP connections, where the Bastion Host acts as the entry point, thereby enhancing the overall security posture by minimizing the attack surface. In contrast, the other options refer to functions that do not align with the purpose of a Bastion Host. Storing large amounts of data securely pertains to services such as Amazon S3 or EBS, which are designed primarily for data storage. Serving as a content delivery network relates to Amazon CloudFront, responsible for delivering content globally with low latency. Managing user permissions across AWS services is a role that falls under AWS Identity and Access Management (IAM), which controls access and permissions for AWS resources. Each of these functions serves distinct purposes within the AWS ecosystem, differentiating them clearly from the role of a Bastion Host.