Parks and recreation staff administer Workspace ONE UEM from a VDI jump box. Which administrative-access design is appropriate?
Select an answer to reveal the explanation.
Short Explanation
Admin consoles belong behind the staff door, not on the picnic-area Wi-Fi. Limit UEM administration to the jump segment over TLS and leave guest and public networks out of it.
Full Explanation
Parks and recreation staff administer Workspace ONE UEM from a VDI jump box by restricting console source IPs to the jump segment and requiring TLS. Admin consoles belong behind the staff door, not on picnic-area guest Wi-Fi. Publishing the UEM admin console on community-center guest Wi-Fi fails by concept because untrusted SSIDs must not be administrative sources for the management plane. Allowing RDP from the internet directly to UEM database servers fails because databases are backend stores, not the admin UI, and internet RDP is an exposure pattern. Placing the UEM admin URL on the same VIP as the public parks reservation website fails because citizen-facing publication conflates public web with privileged console access. Exam caveat: UEM administrative access is source-restricted TLS to the console—not guest SSID, not database RDP, not co-hosting with citizen sites. Operational check: authenticate to the console only from the jump segment over HTTPS, confirm guest and public VIP paths cannot reach admin URLs, and keep database management ports closed from the internet. Record jump CIDRs in the parks security baseline so seasonal community-center SSIDs never inherit console rights.