nerdexam
CompTIA

CAS-003 · Question #352

An information security manager is concerned that connectivity used to configure and troubleshoot critical network devices could be attacked. The manager has tasked a network security engineer with…

The correct answer is B. Use SSH over out-of-band management. SSH over out-of-band (OOB) management satisfies all three requirements: encrypted traffic, segregated management plane, and no reliance on in-band access ports.

Enterprise Security Architecture

Question

An information security manager is concerned that connectivity used to configure and troubleshoot critical network devices could be attacked. The manager has tasked a network security engineer with meeting the following requirements:

  • Encrypt all traffic between the network engineer and critical

devices.

  • Segregate the different networking planes as much as possible.
  • Do not let access ports impact configuration tasks.

Which of the following would be the BEST recommendation for the network security engineer to present?

Options

  • ADeploy control plane protections.
  • BUse SSH over out-of-band management.
  • CForce only TACACS to be allowed.
  • DRequire the use of certificates for AAA.

How the community answered

(35 responses)
  • A
    3% (1)
  • B
    86% (30)
  • C
    9% (3)
  • D
    3% (1)

Why each option

SSH over out-of-band (OOB) management satisfies all three requirements: encrypted traffic, segregated management plane, and no reliance on in-band access ports.

ADeploy control plane protections.

Control plane protections (such as CoPP) protect the control plane from excessive traffic but do not encrypt management sessions or provide out-of-band segregation.

BUse SSH over out-of-band management.Correct

SSH provides strong encryption for all configuration traffic between the engineer and network devices. Out-of-band management uses a physically or logically separate network dedicated solely to device management, which segregates the management plane from the data and control planes. Because OOB uses dedicated management interfaces rather than access or trunk ports, production traffic disruptions do not affect configuration access.

CForce only TACACS to be allowed.

Restricting to TACACS enforces authentication and authorization but does not itself encrypt the configuration session transport or segregate networking planes.

DRequire the use of certificates for AAA.

Certificate-based AAA strengthens authentication but addresses identity verification, not traffic encryption or plane segregation for management access.

Concept tested: Out-of-band management with SSH for secure network device access

Source: https://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Security/SBA_Enterprise_Sep2012_CVD/SBA_Enterprise_Secure_NetworkMgmt_Sep2012_CVD.pdf

Topics

#out-of-band management#SSH#management plane#network device security

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-003 Practice