Which two statements accurately describe good management-plane security practice on network devices?
Secure management protocols like SSH provide encrypted transport and strong authentication for administrative sessions, preventing credential theft and session hijacking over the network. In contrast, protocols such as Telnet or HTTP transmit passwords and configuration data in plaintext, which attackers can easily intercept. Protecting the management plane with encryption is a foundational best practice for network device security.
Why this answer
Good management-plane security combines multiple layers of control. In practical terms, using secure protocols such as SSH is important, but so is restricting which sources may connect, controlling who is authorized, and maintaining visibility into administrative activity. Strong management security is not usually one setting by itself.
This is a layered-control question rather than a single-technology question.
Exam trap
A common exam trap is selecting only one security measure, such as using SSH, and ignoring the importance of restricting management access sources. Candidates might assume that encrypted protocols alone provide complete security, but without source filtering, attackers can still attempt unauthorized connections. Another trap is choosing options that suggest disabling logging or using shared admin accounts, which weaken security by reducing accountability and visibility.
The exam tests understanding that management-plane security is multi-layered, requiring both secure protocols and access restrictions to effectively protect network devices.
Why the other options are wrong
Incorrect because shared generic admin accounts reduce traceability and accountability, making it difficult to audit who made changes or accessed the device, which weakens security.
Incorrect because disabling logging removes visibility into management activities, hindering the ability to detect unauthorized access or troubleshoot issues, which is counterproductive to security.
Incorrect because SSID names pertain to wireless network identification and do not provide any protection for router management-plane access or protocols.
When would these options actually be correct?
If an exam question asked about user management practices in a small, isolated environment where convenience is prioritized over security, and where user accountability is not a concern, then preferring shared generic admin accounts could be considered acceptable.
In a question focused on optimizing performance for low-resource devices in a controlled environment, where logging is deemed unnecessary due to limited access and oversight, disabling logging could be considered acceptable.
In a question focused on basic home network security practices where the context is about minimizing complexity for non-technical users, an option suggesting that SSID names can serve as a layer of obscurity might be considered acceptable.
Why candidates pick the wrong answer
Candidates may choose this option due to a misunderstanding of the balance between convenience and security, believing that shared accounts simplify management without recognizing the security risks involved.
Candidates may choose this option believing that reducing logging will enhance device performance and reduce resource consumption, especially if they have encountered scenarios where excessive logging was an issue.
Candidates may mistakenly believe that SSID names provide a level of security by obscurity, especially if they lack understanding of more robust security measures like encryption and proper access controls.