300-420 Question 271
Select 3An organization is designing a segmented management network to ensure secure and efficient management of its enterprise infrastructure. The network must separate device management traffic from production traffic while allowing administrators to securely access devices from their corporate office. Which of the following design considerations should be implemented to meet these requirements?
- A
Use a dedicated VLAN for management traffic and enforce access control policies.
- B
Implement an out-of-band (OOB) management network for critical devices.
- C
Route management traffic over production VLANs for simplicity.
- D
Secure management access using methods such as SSH and TACACS+.
- E
Enable network address translation (NAT) for management traffic to improve security.
Show answer and explanation
Correct answers: A, B, D
Explanation
To design a segmented management network, it is essential to separate management traffic from production traffic. This can be achieved by using dedicated VLANs and out-of-band management networks. Additionally, secure protocols like SSH and centralized authentication mechanisms like TACACS+ should be implemented to protect management access. Avoid routing management traffic over production VLANs or using NAT, as these do not align with best practices for segmented management networks.
- A. Correct.
A dedicated VLAN for management traffic is a best practice as it separates management data from production traffic, improving security and reducing potential interference.
- B. Correct.
An out-of-band (OOB) management network provides an additional layer of security by physically separating management traffic from production traffic.
- C. Incorrect.
Routing management traffic over production VLANs does not meet the requirement of segregation and could expose management traffic to potential threats.
- D. Correct.
Secure management access using methods like SSH and TACACS+ ensures encrypted communication and centralized authentication, enhancing the security of management traffic.
- E. Incorrect.
Enabling NAT for management traffic is not a recommended practice as it complicates troubleshooting and does not inherently improve security in this context.