mediumMultiple ChoiceObjective-mapped
ISC2 CC Practice Question: A company's security policy requires that all…
A company's security policy requires that all privileged access to critical servers be logged and monitored. The IT team has implemented a jump server (bastion host) for administrators to connect to critical servers. All SSH connections to the jump server are logged, and from there, administrators connect to target servers. The security team notices that some administrators are bypassing the jump server and connecting directly to critical servers from their workstations. The direct connections are not logged. The security team needs to enforce the policy without disrupting operations. Which of the following is the BEST solution?
⚠ Common exam trap
ISC2 often tests the distinction between network-based controls (like a perimeter firewall) and host-based controls, where candidates mistakenly choose a network firewall solution without realizing it does not block internal direct connections from the same subnet.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement a host-based firewall on each critical server to block direct connections.
A host-based firewall on each critical server can enforce the security policy by blocking direct SSH connections (TCP port 22) from any source other than the jump server's IP address. This ensures that all administrative access must go through the jump server, where logging is already in place, without disrupting legitimate operations through the authorized path.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Implement a host-based firewall on each critical server to block direct connections.
Why this is correct
Specifically blocks unauthorized direct connections while allowing jump server traffic.
- ✗
Send a warning email to all administrators reminding them of the policy.
Why it's wrong here
Not enforceable; relies on voluntary compliance and does not prevent bypassing.
- ✗
Disable direct SSH access to critical servers at the network firewall level.
Why it's wrong here
Blocks all direct traffic but may impact legitimate remote management if not carefully configured.
- ✗
Revoke local administrator rights on workstations.
Why it's wrong here
Does not prevent direct SSH connections; administrators can still connect from their workstations.
Go deeper
Related to this question
Learn chapter
Introduction to Security Principles
Key term
Privileged access
Privileged access is a special level of permission that allows a user or system to perform high-impact actions like installing software, changing system settings, or accessing sensitive data across an IT environment.
Key term
Security policy
A security policy is a formal set of rules and guidelines that an organization establishes to protect its information assets and technology resources.
About these practice questions
This CC question is part of Courseiva's 976-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.