Network engineers need to manage switches in a data center from home. The solution must encrypt management traffic, strongly authenticate users, and avoid exposing management ports directly to the internet. Which approach is best?

Telnet to the switches over a router port-forward rule.

Telnet sends credentials in cleartext and exposing management ports directly increases the attack surface.

SSH directly to the switches from the internet using password-only authentication.

SSH encrypts traffic, but direct internet exposure and weak authentication still create unnecessary risk.

Use SNMPv2c with restricted source IP addresses.

SNMPv2c is not secure for administrative access because community strings are weak and easily misused.

What does this SY0-701 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: Connect through a VPN to a bastion host, then use SSH to the switches. — The strongest approach is to require a VPN into a bastion host and then manage the switches with SSH. This keeps administrative services off the public internet, encrypts traffic in transit, and gives the organization a controlled access point that can be monitored and hardened. It also supports stronger authentication and logging than direct exposure. For remote administration, layering secure transport and a jump host is a practical defense-in-depth pattern. Why others are wrong: Telnet is insecure because it transmits credentials in cleartext. Direct SSH is better than Telnet, but exposing management ports to the internet still expands risk. SNMPv2c is not a secure interactive administration channel and should not be used as a primary remote management solution.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.