Which device sits at the border of a network to enforce access control and monitor traffic?

• A. IDS
• B. Firewall
• C. Bastion Host
• D. Proxy Server

Answer: (C)

At the network edge, you want a hardened gateway that acts as the controlled entry point and watches what passes through. A bastion host is built for this role: a heavily fortified server placed at the boundary (often in a DMZ) that runs only essential services and enforces strict access control for external connections. It serves as the gateway into the internal network, applying authentication/authorization and logging or auditing traffic as it crosses the border. Because of its purpose-built security and gatekeeper position, it best fits the description of a device that sits at the border to enforce access control and monitor traffic. By contrast, an IDS mainly watches and alerts on traffic, a firewall enforces policy at the network edge, and a proxy mediates requests without necessarily serving as the fortified border gateway.