CCNA AI and Network Operations Practice Question
Which TWO statements correctly describe characteristics of SNMPv2c and SNMPv3 for network monitoring?
⚠ Common exam trap
Cisco often tests the misconception that SNMPv3 is merely an extension of SNMPv2c with added trap support, when in fact the key differentiator is the security model (authentication and encryption), and both versions support traps.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SNMPv3 supports authentication and encryption for secure network monitoring.
SNMPv3 is correct because it introduces authentication (MD5/SHA) and encryption (DES/AES) for secure monitoring. SNMPv2c is correct because it uses community strings transmitted in cleartext, lacking security. Option C is wrong: SNMPv3 is more secure than v2c, not the same. Option D is wrong: SNMPv2c supports traps in addition to GET and SET. Option E is wrong: SNMPv3 uses usernames and security models, not community strings.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
SNMPv3 supports authentication and encryption for secure network monitoring.
Why this is correct
SNMPv3 is correct because it introduces a User-based Security Model (USM) offering three security levels: noAuthNoPriv (no authentication or encryption, but still uses usernames), authNoPriv (HMAC-MD5 or HMAC-SHA authentication, no encryption), and authPriv (authentication plus DES or AES encryption). This allows network monitoring to operate with data integrity, source authentication, and confidentiality, protecting against sniffing and unauthorized modifications. No other version provides these combined security features, making it suitable for production and large-scale networks.
- ✓
SNMPv2c uses community strings sent in clear text to authenticate requests.
Why this is correct
SNMPv2c uses community strings, which function as shared passwords between manager and agent, but they are sent in cleartext within every SNMP message on UDP port 161. Since no encryption is applied, anyone capturing network traffic can read the community string and gain read or write access to the device's MIB, depending on whether it is a read-only or read-write community. This is a fundamental security flaw because an attacker can use tools like Wireshark to sniff these passwords. Consequently, SNMPv2c is considered insecure for production environments outside trusted networks.
- ✗
SNMPv3 provides the same security level as SNMPv2c but with additional trap support.
Why it's wrong here
This statement is false because SNMPv3 does not merely add trap support beyond v2c; traps are already supported by v2c and even v1. The real difference is that SNMPv3 offers dramatically stronger security through USM, which provides per-user authentication and encryption, while v2c always uses community strings sent in clear text. Additionally, SNMPv3 can be configured to use noAuthNoPriv, authNoPriv, or authPriv, giving flexibility, but it never relies on community strings. Therefore, the security level is not the same; v3 can be much more secure, though it can also be configured insecurely if misconfigured.
- ✗
SNMPv2c supports only GET and SET operations, but not traps.
Why it's wrong here
SNMPv2c actually supports the full set of operations, including Get, GetNext, GetBulk, Set, and importantly Trap (as well as Inform requests). The trap operation allows agents to send unsolicited alerts about events to managers, a critical feature that exists in SNMPv2c just as in SNMPv1 and v3. The claim that v2c lacks traps is false; it supports all standard operations. However, v2c's security is weak because it relies on community strings transmitted without encryption.
- ✗
SNMPv3 uses community strings to authenticate agents and managers.
Why it's wrong here
SNMPv3 does not use community strings at all; it replaces them with the User-based Security Model (USM). In USM, agents and managers authenticate using usernames plus HMAC-MD5 or HMAC-SHA keys, and can optionally encrypt traffic with DES or AES. Community strings like 'public' or 'private' are a legacy SNMPv1/v2c mechanism that SNMPv3 explicitly abandons for stronger, per-user security. Therefore, stating that v3 uses community strings misunderstanding of its security architecture.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓SNMPv3 supports authentication and encryption for secure network monitoring.Correct answer▾
Why this is correct
SNMPv3 is correct because it introduces a User-based Security Model (USM) offering three security levels: noAuthNoPriv (no authentication or encryption, but still uses usernames), authNoPriv (HMAC-MD5 or HMAC-SHA authentication, no encryption), and authPriv (authentication plus DES or AES encryption). This allows network monitoring to operate with data integrity, source authentication, and confidentiality, protecting against sniffing and unauthorized modifications. No other version provides these combined security features, making it suitable for production and large-scale networks.
✗SNMPv3 provides the same security level as SNMPv2c but with additional trap support.Wrong answer — click to see why▾
Why this is wrong here
SNMPv3 provides significantly higher security than SNMPv2c by adding authentication and encryption, whereas SNMPv2c uses only community strings in clear text. Both versions support traps, so the statement incorrectly claims SNMPv3 has additional trap support, which is not a distinguishing feature.
Why candidates choose this
Students may confuse the enhanced security features of SNMPv3 with additional trap functionality, or they might think that SNMPv3 is just a more secure version of SNMPv2c with the same features plus traps, but traps are present in both.
✗SNMPv2c supports only GET and SET operations, but not traps.Wrong answer — click to see why▾
Why this is wrong here
SNMPv2c supports GET, SET, and trap operations, just like SNMPv1 and SNMPv3. The statement is incorrect because it claims SNMPv2c does not support traps, which is false; traps are a key feature for asynchronous notifications in network monitoring.
Why candidates choose this
Test-takers might confuse SNMPv2c with an earlier or limited version, or they may think that traps were only introduced in SNMPv3. However, traps have been part of SNMP since SNMPv1.
✗SNMPv3 uses community strings to authenticate agents and managers.Wrong answer — click to see why▾
Why this is wrong here
SNMPv3 uses the User-based Security Model (USM) with usernames and authentication keys, not community strings. Community strings are a feature of SNMPv1 and SNMPv2c, which are transmitted in clear text and provide weak security.
Why candidates choose this
Students familiar with SNMPv2c may assume that community strings are used across all versions, but SNMPv3 replaced them with a more robust user-based authentication model. The term 'community' might be mistakenly associated with SNMPv3.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
Learn chapter
Agentic AI in Network Operations
Key term
SNMP
SNMP (Simple Network Management Protocol) is an application-layer protocol used to collect and organize information about managed devices on IP networks and to modify that information to change device behavior.
Key term
Network monitoring
Network monitoring is the practice of continuously observing a computer network for issues like slow performance, failures, or security threats to keep it running smoothly and reliably.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.