A network engineer must allow secure access to the Cisco ACI out-of-band (OOB) management only from external subnets 10.0.0.0/24 and 192.168.20.0/25. Which configuration set accomplishes this goal?

Creating an L3Out in the MGMT tenant is for connecting the ACI fabric to external networks for application traffic, not specifically for securing OOB management access itself, which has its own dedicated access control mechanisms.

A PBR (Policy Based Routing) service graph is used for redirecting traffic through specific service devices, which is not the mechanism for defining source-based access control for OOB management.

Creating an EPG and BD in the MGMT tenant in OOB VRF is part of setting up OOB connectivity but does not, by itself, define the specific external source subnets allowed to access the OOB management. The contract is needed for access control.

In Cisco ACI, an OOB contract is explicitly designed to control access to OOB management interfaces, allowing the specification of allowed external IP subnets (subjects) and permitted protocols/ports (filters). This directly enables the desired granular control over who can access the ACI fabric's out-of-band management from the specified source networks.