A production server has port 22 (SSH) open to the internet with password authentication enabled. What are the specific security risks and recommended mitigations?

• A.Internet-exposed SSH with passwords is subject to constant automated brute-force attacks from botnets. Mitigations: disable password auth (PasswordAuthentication no) and use key-based auth; restrict SSH access to specific IP ranges via firewall; use non-standard port or port knocking; implement fail2ban to block repeated failures; consider VPN or bastion host requirement for SSH access
• B.The risk only exists if the server is running a vulnerable SSH version; serving stale content while revalidating is forbidden by HTTP caching rules, and CDNs that do it violate the RFC; an S3 bucket keeps a static site private even with website hosting enabled, requiring signed URLs for every object; TLS 1.0 remains PCI-compliant for public sites when paired with a WAF that inspects the decrypted stream
• C.