CCNA AI and Network Operations Practice Question
Network Topology
You are connected to R1, a Cisco ISR 4321 running IOS-XE. Configure SNMPv2c with a read-only community string 'public' and SNMPv3 with user 'admin' using SHA authentication and AES encryption. Ensure SNMP traps are sent to the management server at 203.0.113.10. Additionally, configure NetFlow export to destination 203.0.113.20 on UDP port 2055 using version 9. Verify your configuration with appropriate show commands. The current running-config is incomplete; you must add the missing commands.
⚠ Common exam trap
Forgetting to include a group name and the 'v3' keyword in the 'snmp-server user' command is a common syntax error that will cause the configuration to be rejected on real devices.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
snmp-server community public ro snmp-server user admin snmp-group v3 auth sha cisco priv aes 128 cisco snmp-server host 203.0.113.10 traps version 2c public ip flow-export destination 203.0.113.20 2055 ip flow-export version 9
The initial config has only a basic SNMPv2c community string. To meet requirements: enable SNMPv3 with a user 'admin' using SHA authentication and AES 128-bit encryption. The correct command requires a group name and the 'v3' keyword, e.g., 'snmp-server user admin snmp-group v3 auth sha cisco priv aes 128 cisco'. Configure SNMP trap destination with 'snmp-server host 203.0.113.10 traps version 2c public'. For NetFlow, use 'ip flow-export destination 203.0.113.20 2055' and 'ip flow-export version 9'. Verify with 'show snmp' and 'show ip cache flow'. Option B incorrectly uses version 3 traps with a community string; version 3 requires a security name. Option C uses insecure MD5/DES56 instead of SHA/AES. Option D uses NetFlow version 5 instead of version 9.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
snmp-server community public ro snmp-server user admin snmp-group v3 auth sha cisco priv aes 128 cisco snmp-server host 203.0.113.10 traps version 2c public ip flow-export destination 203.0.113.20 2055 ip flow-export version 9
Why this is correct
This is the only option that is completely valid: the SNMPv2c read-only community allows basic NMS polling, the SNMPv3 user is properly configured with SHA authentication and AES 128 privacy, and the trap destination uses SNMPv2c with the matching 'public' community string. The NetFlow configuration exports with version 9, the template-based version required. Together, these commands satisfy the SNMP security and NetFlow version requirements without any syntax or semantic error.
- ✗
snmp-server community public ro snmp-server user admin snmp-group v3 auth sha cisco priv aes 128 cisco snmp-server host 203.0.113.10 traps version 3 auth public ip flow-export destination 203.0.113.20 2055 ip flow-export version 9
Why it's wrong here
This configuration fails because the snmp-server host command for trap destinations is written for SNMPv3 with 'auth' but then gives 'public' as the final parameter. In SNMPv3, a community string is never used; the host command must reference the configured SNMPv3 security name (such as 'admin') rather than 'public'. The NetFlow version and SNMPv2c community are correct, but this invalid trap-host line prevents the NMS from receiving authenticated traps.
- ✗
snmp-server community public ro snmp-server user admin snmp-group v3 auth md5 cisco priv des56 cisco snmp-server host 203.0.113.10 traps version 2c public ip flow-export destination 203.0.113.20 2055 ip flow-export version 9
Why it's wrong here
The SNMPv3 user in this option is created with MD5 for authentication and DES 56-bit for privacy, but the security requirements demand SHA and AES 128. MD5 and DES are legacy algorithms that are weaker and are not acceptable when a stronger SHA/AES policy is specified. Because the user's credentials do not match the required algorithms, the SNMPv3 configuration is nonconformant even though the trap host and NetFlow v9 lines are correct.
- ✗
snmp-server community public ro snmp-server user admin snmp-group v3 auth sha cisco priv aes 128 cisco snmp-server host 203.0.113.10 traps version 2c public ip flow-export destination 203.0.113.20 2055 ip flow-export version 5
Why it's wrong here
Here the SNMP commands are all correct, but the NetFlow export version is set to 5 instead of version 9. NetFlow v5 uses a fixed format with no template support, while v9 sends template records that allow flexible field definitions, IPv6, and MPLS metadata. Since the requirement explicitly specifies version 9, specifying version 5 means the device cannot properly export the required NetFlow data.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓snmp-server community public ro snmp-server user admin snmp-group v3 auth sha cisco priv aes 128 cisco snmp-server host 203.0.113.10 traps version 2c public ip flow-export destination 203.0.113.20 2055 ip flow-export version 9Correct answer▾
Why this is correct
This is the only option that is completely valid: the SNMPv2c read-only community allows basic NMS polling, the SNMPv3 user is properly configured with SHA authentication and AES 128 privacy, and the trap destination uses SNMPv2c with the matching 'public' community string. The NetFlow configuration exports with version 9, the template-based version required. Together, these commands satisfy the SNMP security and NetFlow version requirements without any syntax or semantic error.
✗snmp-server community public ro snmp-server user admin snmp-group v3 auth sha cisco priv aes 128 cisco snmp-server host 203.0.113.10 traps version 3 auth public ip flow-export destination 203.0.113.20 2055 ip flow-export version 9Wrong answer — click to see why▾
Why this is wrong here
The trap host line uses 'version 3' and a community string ('public'), but SNMPv3 traps require a security name (the user) and an authentication level, not a community.
Why candidates choose this
Candidates may mistakenly think that the community string 'public' can be used with SNMPv3 traps, or they may confuse the syntax between SNMPv2c and SNMPv3 trap configuration.
✗snmp-server community public ro snmp-server user admin snmp-group v3 auth md5 cisco priv des56 cisco snmp-server host 203.0.113.10 traps version 2c public ip flow-export destination 203.0.113.20 2055 ip flow-export version 9Wrong answer — click to see why▾
Why this is wrong here
The SNMPv3 user is configured with MD5 and DES56, while the requirement is SHA authentication and AES 128‑bit encryption.
Why candidates choose this
Candidates may confuse the default or older SNMPv3 security algorithms (MD5 and DES) with the more secure SHA and AES, or they may not know the exact keywords for SHA and AES.
✗snmp-server community public ro snmp-server user admin snmp-group v3 auth sha cisco priv aes 128 cisco snmp-server host 203.0.113.10 traps version 2c public ip flow-export destination 203.0.113.20 2055 ip flow-export version 5Wrong answer — click to see why▾
Why this is wrong here
The NetFlow export version is set to 5 instead of the required version 9.
Why candidates choose this
Candidates may default to version 5 because it is older and simpler, or they may not remember that version 9 is the required format for modern NetFlow export.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
Learn chapter
Network Management Approaches: Device, Cloud, Controller, Automation, and IaC
Key term
SNMP
SNMP (Simple Network Management Protocol) is an application-layer protocol used to collect and organize information about managed devices on IP networks and to modify that information to change device behavior.
Key term
AES
AES is a fast and secure encryption standard used worldwide to protect sensitive data by scrambling it so only authorized parties can read it.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.