300-410 Practice Test 32 — 15 Questions

Question 1

A network engineer runs the following command on Router R1:

R1# show snmp group

group name: readonly security model: v3 security level: authNoPriv context: <none> read view: iso write view: <none> notify view: <none>

Group name: admin security model: v3 security level: authPriv context: <none> read view: iso write view: iso notify view: iso

Based on this output, which statement is correct?

Accepted Answer

The 'readonly' group can read all MIB objects because its read view is 'iso'.. The output shows two SNMPv3 groups. The 'readonly' group has security level 'authNoPriv', meaning authentication is required but no privacy. The 'admin' group has 'authPriv', requiring both authentication and privacy. The 'readonly' group has no write view, so it cannot modify configurations.

Answer

The 'admin' group requires only authentication, not encryption.

Answer

The 'readonly' group can send SNMP traps.

Answer

Both groups have the same security level.

Question 2

A network engineer runs the following command on Router R1:

R1# show snmp engineID

Local SNMP engineID: 800000090300001122334455
Local SNMP engineBoots: 5

Based on this output, which statement is correct?

Accepted Answer

The SNMP engine has rebooted 5 times.. The output shows the local SNMP engine ID and the number of times the engine has rebooted (engineBoots). The engine ID is used to uniquely identify the SNMP agent. The engineBoots counter is used for SNMPv3 message freshness and security.

Answer

The engine ID is 800000090300001122334455, which is the default for all Cisco devices.

Answer

The engineBoots value is used for SNMPv2c community authentication.

Answer

The engine ID must be the same on all devices in the network.

Question 3

A network engineer runs the following command on Router R1:

R1# show snmp host

Host: 192.168.1.100
Port: 162
Timeout: 1.5 seconds
Retries: 3
Version: 2c
Community: PUBLIC

Host: 192.168.1.200
Port: 162
Timeout: 3 seconds
Retries: 5
Version: 3
User: admin
Security level: authPriv

Based on this output, which statement is correct?

Accepted Answer

SNMP traps sent to 192.168.1.200 will be encrypted.. The output shows two SNMP trap receivers. The first uses SNMPv2c with community 'PUBLIC', while the second uses SNMPv3 with user 'admin' and security level authPriv. The timeout and retry values differ between the two hosts.

Answer

Both hosts use the same SNMP version.

Answer

The host at 192.168.1.100 uses SNMPv3 with user 'admin'.

Answer

Traps to 192.168.1.200 will be sent with community string 'admin'.

Question 4

snmp-server ifindex persist

What is the effect of this configuration?

Accepted Answer

Interface indices are preserved after a device reload.. This command makes SNMP interface indices persistent across reboots. Without it, interface indices may change after a reload, which can cause issues for NMS systems that rely on consistent ifIndex values.

Answer

Interface statistics are cleared on reload.

Answer

SNMP traps are sent for interface state changes.

Answer

The ifIndex is based on the interface name.

Question 5

A network engineer runs the following command on Router R1:

R1# show snmp statistics

SNMP packets input: 150
    Bad SNMP version errors: 0
    Unknown community name: 25
    Illegal operation for community name: 0
    Encoding errors: 0
    Number of requested variables: 300
    Number of altered variables: 0
    Get-request PDUs: 120
    Get-next PDUs: 30
    Set-request PDUs: 0
SNMP packets output: 200
    Too big errors: 0
    No such name errors: 10
    Bad values errors: 0
    General errors: 0
    Response PDUs: 200
    Trap PDUs: 0

Based on this output, which statement is correct?

Accepted Answer

There are 25 SNMP requests with invalid community strings.. The output shows SNMP statistics. There are 25 'Unknown community name' errors, indicating that some SNMP requests are using community strings not configured on the router. Additionally, there are 10 'No such name errors' in the output, meaning the requested MIB objects do not exist. No set requests were received.

Answer

The router has sent 150 trap PDUs.

Answer

There were 10 set requests that failed due to bad values.

Answer

The router received 200 SNMP packets.

Question 6

snmp-server community public RO
snmp-server community private RW
snmp-server community secret RW

What is wrong with this configuration?

Accepted Answer

There is no access list to restrict SNMP access.. Multiple read-write communities are configured (private and secret). While this is allowed, it can be a security risk. More importantly, the 'public' community is read-only, which is typical, but the configuration lacks any access list restrictions, making SNMP accessible from any source if not filtered elsewhere.

Answer

The community strings must be at least 8 characters.

Answer

Only one read-write community is allowed.

Answer

The 'public' community should be read-write.

Question 7

A network engineer runs the following command on Router R1:

R1# show snmp mib

MIB: IF-MIB
MIB: SNMPv2-MIB
MIB: IP-MIB
MIB: CISCO-CONFIG-MAN-MIB
MIB: ENTITY-MIB

Based on this output, which statement is correct?

Accepted Answer

The router supports monitoring of configuration changes via SNMP.. The output lists the MIBs supported by the router. The presence of CISCO-CONFIG-MAN-MIB indicates support for configuration management, such as monitoring configuration changes via SNMP. The other MIBs are standard for interface, SNMP, IP, and entity information.

Answer

The router does not support the IF-MIB.

Answer

The router only supports Cisco proprietary MIBs.

Answer

The ENTITY-MIB is used for entity authentication.

Question 8

What is the default SNMPv2c community string on most Cisco IOS devices?

Accepted Answer

public. By default, many Cisco IOS devices have no SNMP community configured. However, if a community is preconfigured, it is often 'public' with read-only access. The question tests the default state.

Answer

private

Answer

cisco

Answer

No default community string is configured.

Question 9

snmp-server enable traps
snmp-server host 192.168.1.100 traps version 2c public
snmp-server host 192.168.1.200 informs version 2c public

What is the effect of this configuration?

Accepted Answer

Traps are sent to 192.168.1.100 and informs are sent to 192.168.1.200.. This enables all SNMP traps and configures two hosts: one to receive traps (unacknowledged) and one to receive informs (acknowledged). Both use SNMPv2c with the community string 'public'.

Answer

Both hosts receive traps.

Answer

Both hosts receive informs.

Answer

Only traps are enabled; informs require SNMPv3.

Question 10

Which THREE symptoms indicate a problem with SNMP trap delivery from a Cisco router? (Choose THREE.)

Accepted Answer

The NMS does not receive traps, but other SNMP operations (gets) work.. Symptoms of SNMP trap delivery issues include: the 'show snmp' command showing incrementing 'Input queue drops' or 'SNMP queue overflow', traps not appearing at the NMS, and syslog messages indicating SNMP authentication failures. A high CPU load is not specific to SNMP traps, and a successful ping does not guarantee trap delivery.

Answer

The router CPU utilization is consistently above 90%.

Answer

The NMS can ping the router successfully.

Question 11

snmp-server community MyCommunity RO 10
access-list 10 permit 192.168.1.0 0.0.0.255

What is the effect of this configuration?

Accepted Answer

SNMP read-only access is allowed only from the 192.168.1.0/24 subnet.. The SNMP community 'MyCommunity' is restricted to read-only access and is associated with access-list 10, which permits only the 192.168.1.0/24 subnet. This means only SNMP managers in that subnet can use this community for read-only queries.

Answer

SNMP read-write access is allowed from any host.

Answer

SNMP access is allowed from any host, but only read-only.

Answer

The community string is encrypted in the configuration.

Question 12

Which TWO commands would a network engineer use to verify SNMP agent configuration and connectivity on a Cisco IOS router? (Choose TWO.)

Accepted Answer

show snmp. The 'show snmp' command displays SNMP agent status, community strings, and counters, while 'show snmp host' shows the configured SNMP notification receivers. 'show snmp group' and 'show snmp user' are for SNMPv3 configuration, and 'debug snmp packets' is a troubleshooting tool, not a verification command.

Answer

show snmp group

Answer

show snmp user

Answer

debug snmp packets

Question 13

Which TWO statements about SNMPv3 security models are true? (Choose TWO.)

Accepted Answer

The noAuthNoPriv security level provides no authentication and no encryption.. SNMPv3 supports three security levels: noAuthNoPriv (no authentication, no encryption), authNoPriv (authentication with MD5 or SHA, no encryption), and authPriv (authentication and encryption using DES or AES). The 'priv' keyword enables encryption, and authentication is required for both authNoPriv and authPriv.

Answer

The authNoPriv security level uses encryption but no authentication.

Answer

SNMPv3 always requires encryption for all security levels.

Answer

The 'priv' keyword in the snmp-server group command disables authentication.

Question 14

Which TWO configuration steps are required to enable SNMPv3 with authentication and encryption on a Cisco router? (Choose TWO.)

Accepted Answer

snmp-server group GROUP v3 priv. To configure SNMPv3 with authPriv, you must first define an SNMP group with the appropriate security level using 'snmp-server group', then create a user associated with that group using 'snmp-server user' with authentication and privacy passwords. The 'snmp-server community' command is for SNMPv1/v2c, and 'snmp-server host' is for trap destinations.

Answer

snmp-server community PUBLIC ro

Answer

snmp-server host 10.1.1.1 version 3 priv USER

Answer

snmp-server enable traps

Question 15

Which TWO commands are used to troubleshoot SNMPv3 authentication or encryption failures? (Choose TWO.)

Accepted Answer

debug snmp packets. To troubleshoot SNMPv3 issues, 'debug snmp packets' shows the actual SNMP packets being sent/received, including authentication and encryption details. 'show snmp user' displays the configured users and their authentication/privacy settings. 'show snmp group' shows group-level security, but not user-specific details. 'show running-config | include snmp' is too broad, and 'ping' is irrelevant.

Answer

show snmp group

Answer

show running-config | include snmp

Answer

ping <NMS-IP>