Question
A network engineer is installing new switches in the data center to replace existing infrastructure. The previous network hardware had administrative interfaces that were plugged into the existing network along with all other server hardware on the same subnet. Which of the following should the engineer do to better secure these administrative interfaces?
- A. Connect the switch management ports to a separate physical network. Correct
- B. Disable unused physical ports on the switches to keep unauthorized users out.
- C. Set the administrative interfaces and the network switch ports on the same VLAN.
- D. Upgrade all of the switch firmware to the latest hardware levels.
Explanation
Placing switch management ports on a separate, dedicated out-of-band management network isolates the administrative interfaces from the production server subnet, so users and compromised servers cannot reach them. Disabling unused ports is good hardening but does not protect management interfaces that share a subnet with servers. Putting management and data ports on the same VLAN repeats the original problem, and firmware upgrades fix vulnerabilities without separating management traffic.
