Examkin

Question

Difficulty: HardRemote Access and Out-of-Band Management

A network engineering team is hardening the remote management architecture for a critical enterprise data center. Security baseline standards require cryptographic protection for all administrative sessions, central AAA authorization for individual CLI commands, and an independent out-of-band (OOB) pathway capable of providing emergency console access if the core routers experience a complete network stack freeze or primary ISP fiber failure. Which of the following mechanisms should the team deploy to satisfy these requirements? (Select TWO.)

  1. Configure SSH combined with TACACS+ authentication to enforce encrypted command-line management and granular command authorization.Answer
  2. Deploy a terminal server connected via a cellular modem directly to device serial console ports for out-of-band access.Answer
  3. C
    Enable Telnet over port 23 on out-of-band interfaces to minimize protocol overhead during emergency serial recovery sessions.
  4. D
    Implement SNMPv2c across the management network to encrypt out-of-band administrative commands and authenticate individual operators.

Answer

The engineering team must deploy SSH integrated with TACACS+ for secure in-band management and a terminal server attached via cellular modem to device serial console ports for out-of-band management.
SSH paired with TACACS+ satisfies security baseline requirements by providing end-to-end transport encryption combined with centralized, granular command-level authorization. A cellular-backed terminal server wired to physical serial console ports creates a robust out-of-band channel that remains reachable even during primary network outages or device IP stack freezes.

Step-by-Step Solution

1
Analyze security and accessibility requirements
The scenario demands encrypted transport, granular command authorization, and dedicated administrative channels resistant to primary link or device stack failures.
In-band protocols must prevent eavesdropping and unauthorized commands, while out-of-band infrastructure must operate independently of the primary production network path.
2
Evaluate in-band protocol security controls
SSH provides transport-layer encryption, while TACACS+ encrypts the entire payload and supports command-by-command authorization.
Telnet is unencrypted, and SNMPv2c uses cleartext community strings without supporting individual command auditing or session privacy.
3
Evaluate out-of-band physical transport connectivity
Connecting a terminal server to device RS-232 serial console ports with a cellular WAN connection creates an isolated emergency out-of-band pathway.
Serial console access bypasses device network protocol stacks, and cellular modems provide connectivity independent of primary ISP fiber infrastructure.

Key Concept

Secure In-Band Administration and Out-of-Band (OOB) Infrastructure Isolation
Rate this question

Topics

Remote Access and Out-of-Band Management

More questions from this topic