The architect should follow the guideline of assigning access layer switches IP addresses on a VLAN that is dedicated for switch management. This is a best practice for network management security, as it isolates the switch management traffic from the data traffic, and prevents unauthorized access to the switches. A dedicated VLAN for switch management also simplifies the configuration and monitoring of the switches, and reduces the risk of broadcast storms or VLAN hopping attacks.
The other options are not best practices for network management security:
Option B is incorrect because enabling DHCP on only the switch Default VLAN is not a secure way of assigning IP addresses to the switches. DHCP stands for Dynamic Host Configuration Protocol, and it is a protocol that automatically assigns IP addresses and other network parameters to devices on a network. However, DHCP can be vulnerable to spoofing or hijacking attacks, where an attacker can impersonate a DHCP server or client, and obtain or alter the network configuration. Moreover, using the Default VLAN for switch management is not recommended, as it is the VLAN that is assigned to all ports by default, and it can be easily accessed by anyone on the network.
Option C is incorrect because enabling Telnet and setting it to listen on production VLANs is not a secure way of accessing the switches. Telnet stands for Telecommunication Network, and it is a protocol that allows remote login and command execution on a network device. However, Telnet is an insecure protocol, as it sends data in plain text, without any encryption or authentication. This means that anyone who can intercept the network traffic can read or modify the data, and gain unauthorized access to the switches. Moreover, using production VLANs for switch management is not recommended, as it exposes the switch management traffic to the data traffic, and increases the attack surface of the network.
Option D is incorrect because assigning switches static IP addresses on the same VLAN on which APs are deployed is not a secure way of managing the switches. Static IP addresses are fixed IP addresses that are manually configured on a device, and they do not change unless they are changed by the administrator. However, static IP addresses can be prone to human errors, misconfiguration, or duplication, and they can be difficult to manage and update. Furthermore, using the same VLAN for switch management and AP deployment is not recommended, as it mixes the switch management traffic with the wireless traffic, and creates unnecessary overhead and security risks.
References:
ArubaOS-Switch Management and Configuration Guide for WC.16.10)
ArubaOS-Switch Basic Operation Guide for 16.10)
Aruba Certified Design Professional Official Certification Study Guide (HPE6-A47))