SY0-301 · Question #640
Matt, a security administrator, wants to configure all the switches and routers in the network in order to securely monitor their status. Which of the following protocols would he need to configure…
The correct answer is B. SNMPv3. SNMPv3 is the only version of SNMP that provides authentication and encryption, making it the appropriate choice for securely monitoring network device status.
Question
Matt, a security administrator, wants to configure all the switches and routers in the network in order to securely monitor their status. Which of the following protocols would he need to configure on each device?
Options
- ASMTP
- BSNMPv3
- CIPSec
- DSNMP
How the community answered
(47 responses)- A2% (1)
- B91% (43)
- C4% (2)
- D2% (1)
Why each option
SNMPv3 is the only version of SNMP that provides authentication and encryption, making it the appropriate choice for securely monitoring network device status.
SMTP is an email transfer protocol and has no role in monitoring or managing network device status.
SNMPv3 introduced user-based security with MD5 or SHA authentication and DES or AES encryption for message confidentiality, addressing the well-known security weaknesses of SNMPv1 and SNMPv2c, which send community strings in plaintext. Configuring SNMPv3 on switches and routers ensures that monitoring traffic cannot be intercepted or tampered with. The 'v3' designation is critical - plain SNMP without a version specifier typically implies v1 or v2c, which are insecure.
IPSec is a suite of protocols for encrypting IP communications and is not used for device status monitoring or network management.
SNMP without a version qualifier refers to v1 or v2c, which lack authentication and encryption and transmit community strings in cleartext, making them insecure for monitoring.
Concept tested: SNMPv3 secure network device monitoring
Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/snmp/configuration/xe-16/snmp-xe-16-book/nm-snmp-cfg-snmp-support.html
Topics
Community Discussion
No community discussion yet for this question.