A transit authority cannot reach a router over the management VRF after a change. Which access method is best for out-of-band recovery at the device?
Select an answer to reveal the explanation.
Short Explanation
When the management path is down, you can still reach the router locally with a console cable—your out-of-band way back in. You don’t depend on the IP path that failed, unlike Internet SNMP or the other proposed recovery methods.
Full Explanation
When in-band management through a management VRF fails after a change, you need an out-of-band path that does not depend on that VRF or routed IP connectivity to the device. The console port provides local out-of-band CLI access, allowing you to recover the configuration, restore VRF reachability, or fix ACLs even when SSH or HTTPS to the management address is down. It is a last-resort recovery channel on Cisco devices for exactly these failures. SNMP write from the Internet with community public is insecure and still requires IP reachability, so it is not a safe out-of-band recovery method. CAPWAP from a distant AP is a wireless control tunnel, not a router recovery channel. TFTP auto-install via DHCP cannot help if the management VRF path needed to deliver DHCP or TFTP is the path that is broken. Exam caveat: out-of-band means the access path bypasses the failed production or management data plane; do not confuse a management VRF failure with a bricked device, since the console usually still works. Practical check: document console cabling for each PE or edge router, then test recovery in the lab by using the console after a failed VRF change, restoring management reachability, and retesting SSH into the management VRF.