A hospital network must support remote monitoring, configuration backup, and emergency access during a major routing outage that saturates production links. Clinical systems cannot tolerate management traffic competing with patient data, and auditors require isolated administrative paths for privileged access. Which network management design best meets resilience and isolation needs?
Select an answer to reveal the explanation.
Short Explanation
You're giving the crew a private service hallway away from crowded patient corridors. A separate dedicated path keeps fixes reachable even when the main network chokes.
Full Explanation
Out-of-band management is required here because dedicated links and separate interfaces place monitoring, backup, and emergency access on a path that does not depend on production routing or bandwidth, so saturation or a major routing failure does not block visibility and recovery while patient data and management traffic never compete, which also satisfies the auditor demand for isolated privileged paths. In-band management with QoS prioritization and a dedicated management VLAN is sound for steady-state separation, but it fails by concept because VLANs and markings provide only logical separation on the same forwarding plane and still require the production control plane and links to be up, so congestion or routing loss removes management when it is most needed. Encrypted management VPNs with redundant concentrators and centralized authentication are widely used for secure remote administration, but they fail here because the tunnels are overlays that still transit the existing routed network and therefore inherit its outage and saturation fate without providing physical isolation. A redundant NMS cluster with distributed collectors, syslog backup, and automated archiving is excellent for application availability and configuration retention, but it fails because high availability of the manager does not create reachability to agents when the intervening network is down, leaving no emergency path. Exam caveat is to distinguish logical versus physical isolation and to treat words like dedicated links, auxiliary interfaces, console, and terminal server as signals for true out-of-band rather than assuming VLAN, QoS, or VPN equals isolation. Practical check is to shut production uplinks in maintenance and confirm that polling, SSH to management interfaces, syslog receipt, and configuration restore still succeed without measurable impact to clinical traffic.