Question 480
A validation report describes: An installer disables the BMC firewall to make Redfish accessible from every office subnet during rack acceptance. Which technical principle should guide the diagnosis?
Explanation
Correct Answer
This case illustrates that Provisioning convenience does not justify exposing privileged baseboard controllers to broad tenant networks. An engineer should Restrict Redfish and IPMI access to the approved management segment and verify TLS and authorization and independently verify that Access tests deny office VLAN connections while approved OOB automation performs authorized inventory queries.
Incorrect Answers
The option would apply to “Two servers are configured with the same OOB IP address and remote power operations sometimes reach the wrong chassis”. The operational evidence follows from the mechanism that Out-of-band identity must be tied to the correct physical server before any remote administrative action. This question instead requires “Provisioning convenience does not justify exposing privileged baseboard controllers to broad tenant networks”.
The related but distinct situation is “A newly installed rack responds on the host NIC but its BMC address is missing from the protected management subnet”. This case illustrates that Host production-network connectivity does not substitute for reliable out-of-band server control. For the stated problem, “Provisioning convenience does not justify exposing privileged baseboard controllers to broad tenant networks” addresses the central condition.
This option serves the scenario “A commissioning technician leaves every BMC with an identical factory administrator password while assigning publicly routed OOB addresses”. The key distinction is that The BMC can perform remote power and firmware actions independent of the host OS and must be isolated as privileged infrastructure. The present scenario is distinguished by “Provisioning convenience does not justify exposing privileged baseboard controllers to broad tenant networks”.