SK0-004 · Question #242
An administrator has purchased monitoring software that can be configured to alert administrators when hardware and applications are having issues. All devices are configured with SNMP, but the…
The correct answer is A. Setting up a custom community name D. Setting SNMP to read only on the devices. Changing the default SNMP community name and restricting access to read-only are the two primary methods for hardening SNMP security without disabling monitoring.
Question
An administrator has purchased monitoring software that can be configured to alert administrators when hardware and applications are having issues. All devices are configured with SNMP, but the administrator wants to further secure the SNMP traffic. Which of the following settings would BEST provide additional monitoring security? (Select TWO).
Options
- ASetting up a custom community name
- BConfiguring the network to block traffic on port 161
- CConfiguring the Windows Firewall to block port 161
- DSetting SNMP to read only on the devices
- EInstalling new MIBs
How the community answered
(63 responses)- A81% (51)
- B3% (2)
- C11% (7)
- E5% (3)
Why each option
Changing the default SNMP community name and restricting access to read-only are the two primary methods for hardening SNMP security without disabling monitoring.
The default SNMP community name 'public' is universally known and acts like a shared password; replacing it with a custom, non-guessable string prevents unauthorized parties from querying device data.
Blocking port 161 on the network would prevent all SNMP traffic from reaching the monitoring server, completely disabling the monitoring function rather than securing it.
Blocking port 161 on the Windows Firewall of the monitoring server would prevent it from receiving SNMP responses, breaking monitoring entirely.
Setting SNMP to read-only (GET only) on devices prevents attackers who do obtain the community string from issuing SNMP SET commands that could change device configurations, significantly reducing the attack surface.
Installing new MIBs adds vendor-specific OID definitions to the monitoring server to improve data interpretation but provides no security hardening for SNMP communications.
Concept tested: Hardening SNMP community strings and access permissions
Source: https://www.cisco.com/c/en/us/support/docs/ip/simple-network-management-protocol-snmp/13608-snmpv3-best-practices.html
Topics
Community Discussion
No community discussion yet for this question.