A hospital is redesigning management access for switches, wireless controllers and firewalls, must separate clinical traffic from management, restrict administrator access by role, and ensure management remains reachable during congestion or link failure. Which segmented management network and secure management plane design should be selected?
Select an answer to reveal the explanation.
Short Explanation
You would not leave master keys hanging in the lobby for convenience. A segmented VRF with a hardened jump host keeps admin doors locked, logged, and reachable when production links strain.
Full Explanation
The correct design satisfies all three mandates together: dedicated VRF/VLAN isolates management from clinical traffic, ACLs plus jump host enforce least-privilege entry, TACACS+ provides centralized role-based authorization with accounting, and the OOB path preserves access during congestion or link failure. An in-band SSH design with TACACS+, ACLs and redundant routed paths is widely used and preserves strong control and resilience but fails separation because management shares forwarding and fate with production traffic. A dedicated VRF/VLAN design with ACLs, jump host and OOB that relies on local device authentication keeps isolation and survivability but fails role restriction because local accounts cannot enforce consistent granular roles and centralized accounting. A dedicated VRF/VLAN design with ACLs, jump host and TACACS+ over a single in-band link keeps separation and role control but fails reachability because congestion or uplink failure can isolate management when it is needed most. For exams, redundant routed paths do not equal OOB or VRF isolation, and local authentication does not equal TACACS+ roles. Verify clinical VLANs cannot reach SSH/SNMP, confirm per-admin roles in TACACS+ logs, then disconnect production to test OOB.