N10-009 Question 68
Single answerSNMP: 161/162A network administrator deploys a monitoring server to collect interface utilization and device health information from routers and switches across multiple branch offices. The administrator can successfully ping the devices, but the monitoring platform is not receiving unsolicited alerts when an interface goes down. Firewall logs show that traffic from the branch devices to the monitoring server is being denied. Which of the following changes is the MOST likely to resolve the issue?
- A
Allow UDP 162 from the network devices to the monitoring server
- B
Allow TCP 161 from the monitoring server to the network devices
- C
Allow UDP 161 from the network devices to the monitoring server
- D
Allow TCP 162 from the monitoring server to the network devices
Show answer and explanation
Correct answer: A
Explanation
This question tests practical understanding of SNMP port usage in a monitoring deployment. SNMP managers typically poll agents using UDP port 161, while agents send traps or informs to the manager on UDP port 162. Because the monitoring platform is specifically missing unsolicited interface-down alerts, the missing firewall rule is most likely the one permitting UDP 162 inbound to the monitoring server from the managed devices. This aligns with standard SNMP behavior as documented in common vendor guidance and SNMP operational references: polling traffic uses port 161, and notification traffic uses port 162.
- A. Correct.
Correct. SNMP traps and informs are typically sent from managed devices to the SNMP manager on UDP port 162. In this scenario, the monitoring server is not receiving unsolicited alerts such as interface-down notifications, which indicates that trap traffic destined for the manager is likely being blocked. Permitting UDP 162 from the devices to the monitoring server is the most appropriate fix.
- B. Incorrect.
Incorrect. Standard SNMP polling uses UDP, not TCP, and the issue described is with unsolicited alerts rather than manager-initiated queries. A candidate might choose this option by remembering port 161 is related to SNMP, but using TCP and the wrong traffic direction makes this incorrect.
- C. Incorrect.
Incorrect. UDP 161 is commonly used for SNMP queries and responses between the manager and agents, primarily for polling device status or retrieving management information. However, the problem here involves traps/alerts sent to the monitoring server, which use UDP 162, not UDP 161.
- D. Incorrect.
Incorrect. SNMP notifications do not normally use TCP 162. SNMP trap traffic is typically sent over UDP 162 to the manager. This option also reverses the likely traffic pattern because the branch devices are the ones generating the alerts.