A financial firm with separate trading and back-office VRFs must isolate SSH and SNMP access, enforce authentication, and log management changes to meet audit requirements. Which management plane design creates a segmented and secure management network for this firm?
Select an answer to reveal the explanation.
Short Explanation
You're guarding the keys to the vault, not leaving them on desks. Isolated management keeps control traffic separate and accountable, like a locked security office with a sign-in log.
Full Explanation
The correct design succeeds because a dedicated management VRF creates routing and policy separation from trading and back-office production VRFs, while ACLs restrict SSH and SNMP to authorized jump hosts, AAA enforces authentication, authorization and accounting, and centralized logging provides tamper-resistant audit trails for management changes. The in-band alternative that carries SSH and SNMP inside trading and back-office VRFs fails on segmentation by concept because management traffic shares production routing tables and fate, which increases blast radius and audit scope despite strong AAA and syslog. The isolated VRF relying on local device buffers fails on auditability by concept because local logs rotate, diverge in time, and can be lost on reboot or compromise, whereas financial compliance requires centralized syslog with NTP and protected transport. The isolated VRF allowing Telnet and SNMPv2c fails on secure access by concept because Telnet exposes credentials in cleartext and SNMPv2c lacks encryption and strong authentication, whereas SSHv2 and SNMPv3 with authPriv are expected for secure management. Exam caveat is to distinguish commonly deployed convenience designs from compliant designs and to require full VRF isolation plus AAA plus centralized logging when all three are explicitly stated. Practical check is to verify VRF route-target separation, test that SSH and SNMPv3 are reachable only via the management VRF, confirm AAA accounting records, and confirm configuration changes appear immutably in the central collector.