On the city’s core switches, management SSH and SNMP share the same VLANs and paths used by ordinary user data, with no ACL restricting who can reach the management plane. Which change best improves transport architecture security?
Select an answer to reveal the explanation.
Short Explanation
If anyone on the user network can knock on the switch’s admin door, you’ve mixed the control room with the lobby. Put management on its own path with locks, and keep day-to-day data traffic away from those interfaces.
Full Explanation
When management SSH and SNMP share the same VLANs and paths as ordinary user data, any compromised endpoint or curious insider on the production data plane can reach device administration interfaces. Separating management and control access onto dedicated management networks or VRFs, then restricting those paths with strict ACLs, restores a control-plane boundary: operators administer switches from jump hosts on the management fabric while user traffic stays on the data plane. That separation reduces accidental exposure, shrinks the attack surface for credential attacks against network devices, and makes monitoring of administrative access clearer.
Moving all user VLANs onto the management VRF so operators can troubleshoot from any desk inverts the model and floods the management plane with the entire campus population. Disabling SSH in favor of HTTP administration from the public Internet replaces a strong remote shell with a weaker, widely attacked web surface on an untrusted path. Allowing Telnet from any campus subnet for break-glass without logging reintroduces cleartext credentials and unaccountable access—the opposite of managed emergency procedures.
Exam caveat: CISSP transport and network architecture questions expect management-plane isolation. Break-glass access should still be authenticated, logged, and narrowly scoped—not open cleartext from everywhere.
Operational check: place switch management addresses only in management VRFs; ACL-permit jump hosts and NMS ranges only; disable Telnet and unauthenticated HTTP admin; verify user VLANs cannot ARP or route to management IPs; and review logs for unexpected sources attempting SSH or SNMP to core devices.