A production server has port 22 (SSH) open to the internet with password authentication enabled. What are the specific security risks and recommended mitigations?

• A.Internet-exposed SSH with passwords is subject to constant automated brute-force attacks from botnets. Mitigations: disable password auth (PasswordAuthentication no) and use key-based auth; restrict SSH access to specific IP ranges via firewall; use non-standard port or port knocking; implement fail2ban to block repeated failures; consider VPN or bastion host requirement for SSH access
• B.Passwords on an internet-exposed SSH service invite credential stuffing from leaked databases and protocol downgrade to SSH-1. Mitigations: set PermitRootLogin yes with a long password (it resists brute force); restrict access with TCP wrappers in hosts.allow; run sshd under a chroot jail; add a banner with a legal notice (MaxAuthTries 10) and rely on logwatch summaries for response; schedule a monthly review of authorized_keys by the system owner
• C.