300-420 Question 274
Select 3An organization is deploying a segmented management network to enhance security and simplify administrative access to devices. They want to ensure management traffic is isolated from production traffic while allowing administrators to securely access devices over the network. Which of the following design considerations should they implement?
- A
Use a dedicated VRF to segregate management traffic from production traffic.
- B
Leverage 802.1Q VLAN tagging to create a separate VLAN for management devices.
- C
Enable direct SSH access from any production subnet to management devices.
- D
Configure ACLs to restrict access to the management network to specific IP ranges.
- E
Route management traffic through the main production network to minimize configuration complexity.
Show answer and explanation
Correct answers: A, B, D
Explanation
Segmented management networks are designed to isolate management traffic from production traffic, improving security and control. This can be achieved by using dedicated VRFs, VLANs, and ACLs to ensure proper segmentation and access restrictions. Direct access from production networks and routing through the production network undermine the principles of segmentation and should be avoided.
- A. Correct.
Using a dedicated VRF allows for logical separation of management traffic, ensuring security and isolation from production traffic.
- B. Correct.
802.1Q VLAN tagging provides a layer-2 segmentation method to separate management devices from production devices, improving security.
- C. Incorrect.
Allowing direct SSH access from production subnets to management devices is a security risk and violates the principle of segmented management networks.
- D. Correct.
Configuring ACLs to restrict access ensures that only authorized IP ranges can communicate with the management network, improving security.
- E. Incorrect.
Routing management traffic through the main production network defeats the purpose of segmentation and increases the risk of unauthorized access.