N10-009 Question 242
Select 2Connection methods: SSH, Graphical user interface (GUI), API, Console, Jump box/host, In-band vs. out-of-band managementA network administrator is deploying a new branch router at a site with no on-site IT staff. After a configuration change, the WAN circuit goes down and the router can no longer be reached over the production network. Management still needs a secure way to access the device remotely without exposing direct administrative access from the internet. Which TWO solutions would best meet these requirements?
- A
Use an out-of-band management connection to the router's console port through a terminal server or cellular management link
- B
Require administrators to connect first to a hardened jump box, and then SSH to managed devices from that host
- C
Use the router's web GUI over HTTP from any administrator workstation on the internet
- D
Continue using in-band SSH to the router's production IP address because SSH is encrypted
- E
Rely on the device's REST API over the same failed WAN path because APIs are separate from interactive sessions
Show answer and explanation
Correct answers: A, B
Explanation
The best answers are the out-of-band console access method and the use of a jump box. Network management access is commonly divided into in-band and out-of-band methods. In-band management uses the same production network that carries user and application traffic, such as SSH, HTTPS GUI access, or API calls to the device's management IP. If that network path fails, in-band management is typically lost as well. Out-of-band management uses a separate path, such as a console server, dedicated management network, or cellular link, allowing administrators to recover devices even during production outages. For secure remote administration, best practices favor encrypted protocols such as SSH and controlled access through a bastion or jump host rather than exposing device management interfaces directly to the internet. These practices align with common vendor and industry guidance from sources such as Cisco secure management recommendations and NIST guidance on restricting and auditing administrative access.
- A. Correct.
Correct. An out-of-band management path uses a separate management channel that does not depend on the production network being available. Accessing the router through its console port via a terminal server, dedicated management network, or cellular management link is a standard recovery method when in-band connectivity is unavailable. This is especially useful after a bad configuration change or WAN outage.
- B. Correct.
Correct. A jump box (jump host) provides a controlled administrative entry point. Requiring admins to connect to a hardened jump box first, then use SSH to devices, reduces the exposure of management services and supports auditing and access control. This addresses the requirement to avoid exposing direct administrative access from the internet.
- C. Incorrect.
Incorrect. A web GUI can be a valid management method, but exposing it directly to the internet is not a best practice, and HTTP is not encrypted. Even if HTTPS were used, the scenario specifically requires avoiding direct internet exposure of administrative access. This option also does not help if the production path is down.
- D. Incorrect.
Incorrect. SSH is encrypted and is a preferred in-band management protocol, but it still depends on the production network path to the router. In this scenario, the WAN circuit is down and the router is unreachable over that path, so in-band SSH to the production IP will not solve the access problem.
- E. Incorrect.
Incorrect. An API is just another management interface and typically still relies on IP connectivity to the device. If the same WAN path has failed, the API will be unreachable just like SSH or a GUI. The misconception is that an API is somehow independent of the transport path; it is not.