A hospital must isolate device administration for switches, wireless controllers and firewalls after an audit found SSH open from patient Wi-Fi. The design needs role-based access, logged sessions, and reachability that survives a campus core link failure, with management traffic never mixed with clinical data. Which segmented management design best secures the management plane?

The correct design meets all constraints together: a dedicated management VRF isolates administration into its own routing instance so SSH to switches, controllers and firewalls is unreachable from patient Wi-Fi and clinical subnets, OOB-capable redundant paths preserve reachability during a campus core failure, TACACS+ enforces role-based access with per-command authorization, and centralized logging provides audit-ready records. The dedicated VRF design using local device accounts fails the identity concept because local users cannot provide scalable roles, centralized policy control, or consistent authorization. The isolated VLAN design dependent on a single path through the core fails the resilience concept because management fate-shares with one uplink and is lost in the exact failure it must survive. The in-band design using the clinical VRF with redundant paths and TACACS+ fails the segmentation concept because sharing production routing mixes management with clinical data and preserves lateral movement risk. For exams, separate secure access from survivable segmented access, since encrypted in-band or single-homed designs look sound until checked against authorization, alternate path, and no-mixing needs. Practically, verify patient Wi-Fi cannot route to management, review accounting for actions taken, then disable the primary core link in maintenance and confirm SSH still succeeds via the backup path with logs arriving centrally.