N10-009 Question 205
Single answerMethods: SNMP (Traps, Management information base (MIB), Versions (v2c, v3), Community strings, Authentication)A network administrator is deploying a new monitoring platform to manage core switches across multiple sites. The company requires encrypted management traffic and per-user authentication for SNMP queries. The administrator also wants the switches to send immediate notifications to the monitoring server when an interface goes down. Which configuration should the administrator implement to meet these requirements?
- A
Configure SNMPv2c with a complex read-write community string and enable traps to the monitoring server
- B
Configure SNMPv3 with authentication and privacy, create user-based credentials, and enable traps or informs to the monitoring server
- C
Configure SNMPv1 with a read-only community string and poll the MIB more frequently instead of using traps
- D
Configure SNMPv3 without privacy, use a shared community string for all devices, and rely on periodic polling only
Show answer and explanation
Correct answer: B
Explanation
The best answer is to use SNMPv3 with authentication and privacy enabled, along with event notifications such as traps or informs. In practical network operations, this is the preferred approach when security requirements include confidentiality and stronger access control. SNMPv1 and SNMPv2c rely on community strings, which function like shared passwords but are not encrypted. SNMPv3 introduces the User-based Security Model (USM), supporting authentication and privacy features that are commonly described as auth and priv. The Management Information Base (MIB) defines the objects that can be queried or monitored, such as interface status counters, but polling MIB objects alone does not provide the fastest possible notification of failures. Traps and informs are used to send asynchronous alerts from the agent to the manager when key events occur. This aligns with common vendor documentation and IETF SNMPv3 best practices, which recommend SNMPv3 over earlier versions when security is a concern.
- A. Incorrect.
Incorrect. SNMPv2c uses community strings for access control, but community strings are sent in clear text and do not provide encryption or per-user authentication. While traps can be enabled in SNMPv2c, this option does not satisfy the company's requirement for encrypted management traffic and stronger authentication.
- B. Correct.
Correct. SNMPv3 is the version designed to provide improved security through user-based authentication and optional encryption, commonly referred to as authentication and privacy. This aligns with the requirement for per-user authentication and encrypted management traffic. Enabling traps or informs allows devices to send immediate event notifications, such as interface-down events, to the monitoring server instead of waiting for the next polling interval.
- C. Incorrect.
Incorrect. SNMPv1 is outdated and lacks the security features required in this scenario. A read-only community string may reduce risk compared to read-write access, but it still does not provide encryption or modern authentication. Polling the MIB more frequently can help detect issues sooner, but it does not replace the value of event-driven notifications like traps for immediate alerting.
- D. Incorrect.
Incorrect. SNMPv3 without privacy can provide authentication, but it does not encrypt traffic. In addition, SNMPv3 does not use community strings; it uses user-based security. Relying only on periodic polling also fails to meet the requirement for immediate notifications when an interface goes down.