Exercise 2: Why Use a Jump/Bastion Host — Possible Solution ==================================================================== WHAT THIS CHAPTER SAYS ------------------------------ Per this chapter, "concentrating the exposed attack surface onto one well-monitored machine, rather than every internal server needing to individually defend itself against internet-facing attacks, is exactly the same logic behind not exposing the database port directly." WHY CONCENTRATING EXPOSURE HELPS ------------------------------ If every internal server were directly reachable from the internet, each one would need to be independently hardened, patched, and monitored against external attack - a large number of individual attack surfaces to secure and watch. With a bastion host as the only externally-reachable machine, there's exactly one entry point that needs that same level of scrutiny, and every internal server behind it is never directly exposed to the internet at all. WHY THIS IS THE SAME PRINCIPLE AS THE DATABASE EXAMPLE ------------------------------ Just as restricting a database to localhost-only reduces how many ways it can be reached from outside, restricting SSH access to only the bastion host reduces how many machines are directly reachable from outside at all - both are applications of the same underlying idea: minimize the number of exposed entry points, and put extra scrutiny on the ones that remain. WHY THIS MAKES MONITORING MORE PRACTICAL TOO ------------------------------ A single, well-monitored bastion host is far easier to watch closely (logging every connection, applying strict hardening) than dozens or hundreds of individual internal servers each needing the same level of attention - concentrating exposure also concentrates where defensive effort needs to be focused. WHY THIS WORKS AS AN ANSWER ------------------------------ It states the chapter's own explicit reasoning connecting the bastion host pattern to the same principle as the database-exposure example, and explains concretely why reducing the number of exposed entry points reduces overall risk and makes monitoring more practical.