An organization is designing its network security architecture and the CISO requires separation between the management plane of network devices and the data plane. What does this separation achieve?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because separating the management plane from the data plane ensures that even if an attacker gains a presence on the production network (data plane), they cannot reach management interfaces (SSH, SNMP, console) which reside on a separate out-of-band management network. A is wrong because plane separation is a security architecture decision, not a performance optimization.
Full explanation below image
Full Explanation
B is correct because separating the management plane from the data plane ensures that even if an attacker gains a presence on the production network (data plane), they cannot reach management interfaces (SSH, SNMP, console) which reside on a separate out-of-band management network. A is wrong because plane separation is a security architecture decision, not a performance optimization. C is wrong because plane separation may require additional management infrastructure, potentially increasing cost. D is wrong because modern network hardware already achieves data-plane performance through ASIC forwarding regardless of management plane separation.