During a routing outage on the production network, administrators lost access to every firewall and switch they needed to fix it, because management traffic shares the data interfaces. Which design keeps management reachable when the data network is down?
Select an answer to reveal the explanation.
Short Explanation
In-band management is like keeping the spare key inside the house you're locked out of. An out-of-band network is a separate road to every device, so when the main highway is closed you can still drive up. Watch the separate-VLAN trap; a VLAN still rides the same broken links.
Full Explanation
In-band management uses the same interfaces, links and routing as production traffic, so any failure of the data network, such as a routing problem, a loop or a misconfigured ACL, can cut administrators off from the very devices they need to repair. Out-of-band management provides a separate path, using dedicated management interfaces connected to a separate switch and network, often with console servers for serial access, so device reachability does not depend on the production control plane. It keeps working during outages and isolates management from user traffic. A dedicated management VLAN improves separation, but the VLAN is still carried over the production trunks and routed through the core, so the same outage takes it down. A jump host on the production server VLAN is a good control for auditing and restricting access, but it is reached through the failed network and is itself unreachable. SNMPv3 with authentication and privacy protects monitoring traffic, but encryption does nothing for reachability; it rides the same in-band path. Exam caveat: on Cisco Secure Firewall the dedicated management interface is a natural fit for an out-of-band network, but it needs its own gateway and routing. Operational check: disconnect a device's production uplinks in a maintenance window and confirm SSH and manager connectivity remain available over the management network.