352-001 · Question #7
Which two practices should you implement to increase SNMPv1 security? (Choose two.)
The correct answer is B. Use ACLs to allow only specific IP addresses to poll SNMP. C. Use a combination of alphanumeric characters for the community strings. Since SNMPv1 cannot be upgraded to use encryption, the best mitigations are restricting which hosts can query SNMP via ACLs and using strong, complex community strings to make them harder to guess.
Question
Which two practices should you implement to increase SNMPv1 security? (Choose two.)
Options
- ARestrict access to the specific SNMP engine IDs in use.
- BUse ACLs to allow only specific IP addresses to poll SNMP.
- CUse a combination of alphanumeric characters for the community strings.
- DUse SNMP encryption for transport confidentiality.
How the community answered
(33 responses)- A3% (1)
- B91% (30)
- D6% (2)
Why each option
Since SNMPv1 cannot be upgraded to use encryption, the best mitigations are restricting which hosts can query SNMP via ACLs and using strong, complex community strings to make them harder to guess.
SNMP engine IDs are an SNMPv3 concept used for identifying SNMP entities in the USM security model - they do not exist in SNMPv1 and restricting them has no effect on SNMPv1 security.
Applying ACLs to permit only trusted management station IP addresses to send SNMP queries directly limits the attack surface, preventing unauthorized hosts from ever reaching the SNMP agent even if they know the community string.
Using complex alphanumeric community strings reduces the risk of brute-force or dictionary-based discovery of the community string, which is especially important given that SNMPv1 cannot encrypt them in transit.
SNMPv1 has no support for transport encryption - encrypted SNMP is only available in SNMPv3 using its privacy (priv) security level with DES or AES.
Concept tested: SNMPv1 security hardening with ACLs and strong community strings
Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/snmp/configuration/xe-16/snmp-xe-16-book/nm-snmp-cfg-snmp-support.html
Topics
Community Discussion
No community discussion yet for this question.