CCNA AI and Network Operations Practice Question
Network Topology
You are connected to R1, a router that must send SNMP traps to a management server at 203.0.113.10 and export NetFlow data to a collector at 203.0.113.20. Currently, SNMPv2c traps are not being sent, and SNMPv3 is not configured for read-only access with authentication and privacy. Additionally, NetFlow export is missing the destination and version configuration. Configure the necessary commands on R1 to enable SNMPv2c traps (community string 'public'), configure SNMPv3 user 'admin' with SHA authentication and AES 128 encryption (password 'cisco123' for both auth and priv), and set NetFlow export to version 9.
⚠ Common exam trap
Watch out for the SNMPv3 group keyword: 'priv' is required when using encryption (AES 128), not just 'auth'. Also, remember that the 'snmp-server user' command requires a group name. For NetFlow, the version is set with 'ip flow-export version 9', not 'ip flow-export destination'.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
snmp-server host 203.0.113.10 traps version 2c public snmp-server group MyGroup v3 priv snmp-server user admin MyGroup v3 auth sha cisco123 priv aes 128 cisco123 ip flow-export version 9
The configuration is missing SNMPv3 user setup, trap destination, and NetFlow export version. First, enable SNMPv2c traps with `snmp-server host 203.0.113.10 traps version 2c public`. Then, configure SNMPv3 user with `snmp-server user admin MyGroup v3 auth sha cisco123 priv aes 128 cisco123` after creating a group with `snmp-server group MyGroup v3 priv`. For NetFlow, set the export version with `ip flow-export version 9`. Finally, verify with `show snmp` to see trap host and v3 user, and `show ip cache flow` to confirm export configuration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
snmp-server host 203.0.113.10 traps version 2c public snmp-server group MyGroup v3 priv snmp-server user admin MyGroup v3 auth sha cisco123 priv aes 128 cisco123 ip flow-export version 9
Why this is correct
Ly configures SNMPv2c traps with community 'public' to the management server, creates an SNMPv3 group with privacy (required for AES encryption), defines the SNMPv3 user with SHA authentication and AES 128 encryption, and sets NetFlow export to version 9.
- ✗
snmp-server host 203.0.113.10 traps version 2c public snmp-server group MyGroup v3 auth snmp-server user admin MyGroup v3 auth sha cisco123 priv aes 128 cisco123 ip flow-export version 9
Why it's wrong here
The SNMPv3 group is defined with v3 auth, which restricts the group to the authNoPriv security level. The user, however, is configured with priv aes 128, requiring the authPriv security level that includes encryption. Because the group's security level is lower than the user's, the AES privacy settings cannot be negotiated; the user must belong to a group configured with v3 priv to support the requested encryption.
- ✗
snmp-server host 203.0.113.10 traps version 2c public snmp-server user admin v3 auth sha cisco123 priv aes 128 cisco123 ip flow-export version 9
Why it's wrong here
The SNMPv3 user configuration references a group named MyGroup, but this option never creates that group with snmp-server group. In SNMPv3, users are bound to groups to inherit access control policies, so without the group command the user is orphaned and the router cannot associate any view, read/write permissions, or security requirements. As a result, the snmp-server user command fails to create a usable user account.
- ✗
snmp-server host 203.0.113.10 traps version 2c public snmp-server group MyGroup v3 priv snmp-server user admin MyGroup v3 auth sha cisco123 priv aes 128 cisco123 ip flow-export destination 203.0.113.20 2055
Why it's wrong here
This option configures the SNMPv2c trap host and the SNMPv3 group/user correctly, but it replaces the required ip flow-export version 9 with ip flow-export destination 203.0.113.20 2055. The destination command only specifies the NetFlow collector's IP address and UDP port; the export format version remains at the default (typically v5) or whatever was previously configured. Since the question explicitly asks to set the export version to 9, this option is missing that essential command.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓snmp-server host 203.0.113.10 traps version 2c public snmp-server group MyGroup v3 priv snmp-server user admin MyGroup v3 auth sha cisco123 priv aes 128 cisco123 ip flow-export version 9Correct answer▾
Why this is correct
Ly configures SNMPv2c traps with community 'public' to the management server, creates an SNMPv3 group with privacy (required for AES encryption), defines the SNMPv3 user with SHA authentication and AES 128 encryption, and sets NetFlow export to version 9.
✗snmp-server host 203.0.113.10 traps version 2c public snmp-server group MyGroup v3 auth snmp-server user admin MyGroup v3 auth sha cisco123 priv aes 128 cisco123 ip flow-export version 9Wrong answer — click to see why▾
Why this is wrong here
The group keyword 'auth' only enables authentication, not encryption. AES 128 requires the 'priv' keyword.
Why candidates choose this
Candidates may think 'auth' is sufficient because authentication is configured, but encryption requires the group to be set to 'priv'.
✗snmp-server host 203.0.113.10 traps version 2c public snmp-server user admin v3 auth sha cisco123 priv aes 128 cisco123 ip flow-export version 9Wrong answer — click to see why▾
Why this is wrong here
The 'snmp-server user' command requires a group name. Omitting the group will result in an error or incomplete configuration.
Why candidates choose this
Candidates might think that the user can be created without a group, but SNMPv3 requires a group to define access and security levels.
✗snmp-server host 203.0.113.10 traps version 2c public snmp-server group MyGroup v3 priv snmp-server user admin MyGroup v3 auth sha cisco123 priv aes 128 cisco123 ip flow-export destination 203.0.113.20 2055Wrong answer — click to see why▾
Why this is wrong here
The command 'ip flow-export destination' sets the collector IP and port, not the export version. The version is set with 'ip flow-export version 9'.
Why candidates choose this
Candidates often confuse the commands for setting the export destination versus the export version, especially when both are needed in a full configuration.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
Learn chapter
Network Management Approaches: Device, Cloud, Controller, Automation, and IaC
Key term
NetFlow
NetFlow is a network protocol developed by Cisco that collects and monitors IP traffic data to provide visibility into network usage, performance, and security.
Key term
SNMP
A network protocol used to collect and organize information about managed devices on IP networks and to modify that information to change device behavior.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.