A seaport terminal operator runs 120 switches and routers across piers and warehouses on one campus core. Operations requires SSH and SNMP to stay reachable during a broadcast storm, syslog to never mix with cargo Wi-Fi, and TACACS+ authentication for all device logins. Which secure management plane design meets all three needs?
Select an answer to reveal the explanation.
Short Explanation
You’re giving your switches a private back hallway that stays open when the lobby floods. Isolation plus CoPP and tight ACLs keeps SSH, SNMP, and syslog reachable and clean.
Full Explanation
A segmented management plane uses a dedicated virtual routing instance or physically separate out-of-band network so management protocols never share fate or addressing with user traffic, which preserves reachability during storms or floods because control traffic takes a different path and queue. Control Plane Policing rate-limits traffic punched to the CPU so SSH and SNMP remain responsive under attack while excess is dropped, and infrastructure ACLs plus TACACS+ restrict which jump hosts and users can access the plane for authentication and accounting. Placing management in the production VRF with QoS markings fails by concept because marking offers preference but not fate separation, so a flood still congests the same table and links and syslog still mixes with user traffic. Extending user VLANs for management fails by concept because Layer 2 extension expands blast radius and relies on access-port features that do not isolate the CPU or enforce administrative access control. Internet-reachable management with local passwords fails by concept because exposure plus weak, non-centralized authentication violates secure access principles and provides no survivability. For the exam, remember CoPP protects the CPU while management VRFs protect paths and tables, and in practice verify from a user VRF that SSH fails while it succeeds from the jump host.