Auditors require firewall and switch management sessions to be isolated from user traffic, and the team proposes a dedicated out-of-band management network. Which statement describes the main benefit and the main cost of this design?
Select an answer to reveal the explanation.
Short Explanation
A private service road is great: no traffic jams and no strangers. But somebody still has to pave it, light it and put a gate on it. Don't let anyone tell you isolation replaces encryption or AAA, or that a VLAN on the same links counts as a separate road.
Full Explanation
An out-of-band management network gives each device a dedicated management connection to a separate network. The benefits are isolation, because user and internet traffic cannot reach management interfaces directly, and resilience, because administrators keep access when the production network fails. The costs are real: additional cabling, switch ports or switches, console servers, addressing and routing, and the management network itself must be secured and monitored, since it holds the keys to every device. Isolation does not encrypt anything; management sessions still need secure protocols such as SSH and HTTPS, because a compromised host on the management network could otherwise capture credentials. Isolation also does not remove the need for AAA; centralized authentication, per-administrator authorization and accounting remain essential for accountability and least privilege, and are typically required by the same auditors. A separate VLAN carried over production links is a form of in-band management; it is cheaper but shares the physical path and failure modes of the data network, so it is not free out-of-band management. Exam caveat: many designs combine a dedicated management network with in-band access as a backup, each protected by ACLs and AAA. Operational check: verify that management interfaces are reachable only from the management network, that SSH and HTTPS are enforced, and that every login is recorded by the AAA server.