Examkin

Question

Difficulty: MediumNetwork Device Hardening Best Practices

A network technician needs to isolate administrative access for core switches situated in an unstaffed facility. The security policy dictates that remote administrative management traffic must be completely separated from user data traffic so that compromised production host networks cannot reach the switch management interfaces. Which of the following strategies best fulfills this security requirement?

  1. Configure switch management interfaces within a dedicated Virtual Routing and Forwarding (VRF) instance and restrict management protocols to that isolated network.Answer
  2. B
    Assign administrative management access to the default native VLAN on all production trunk links while relying on VTY access control lists.
  3. C
    Enable SNMPv2c read-only community strings across all active production ports to allow centralized out-of-band network monitoring.
  4. D
    Enable Telnet access on the loopback interface with TACACS+ authentication to encrypt remote management sessions across production subnets.

Answer

Configure switch management interfaces within a dedicated Virtual Routing and Forwarding (VRF) instance and restrict management protocols to that isolated network.
Out-of-band (OOB) management using a dedicated management VRF or physical management interface ensures management traffic remains completely segregated from production data paths. This prevents hosts on production subnets from reaching or probing management interfaces.

Step-by-Step Solution

1
Analyze the security requirement
Identified the core requirement: total isolation of management traffic (out-of-band) from user data traffic.
Preventing production host networks from reaching administrative interfaces mitigates unauthorized management plane access.
2
Evaluate network device hardening best practices
Implementing Out-of-Band (OOB) management via a dedicated physical management port or isolated VRF provides complete separation between administrative plane traffic and data plane traffic.
Traffic in a dedicated management VRF cannot be routed or accessed from the global production routing table.

Key Concept

Out-of-band management plane isolation
Estimated Time:1m 30s
Rate this question

Topics

Network Device Hardening Best Practices

More questions from this topic