CCNA AI and Network Operations Practice Question
Exhibit
Current running-config of R1 (relevant sections): ! hostname R1 ! interface GigabitEthernet0/0 ip address 192.0.2.1 255.255.255.252 no shut ! interface GigabitEthernet0/1 ip address 198.51.100.1 255.255.255.0 no shut ! ip route 0.0.0.0 0.0.0.0 192.0.2.2 ! end
You are connected to R1, a Cisco ISR 4331 router running IOS-XE. Your task is to enable SNMP v2c with community string 'public' (read-only) and 'private' (read-write), and configure SNMP v3 with a user 'admin' using SHA authentication (password 'Cisco123') and AES 128 encryption (password 'Cisco456'). Additionally, configure SNMP traps to be sent to a management server at 203.0.113.10 for both v2c and v3. Finally, enable NetFlow export to a collector at 203.0.113.20, using version 9. Verify your configuration using 'show snmp' and 'show ip cache flow'.
⚠ Common exam trap
Watch out for common mistakes: using MD5/DES instead of SHA/AES for SNMPv3, forgetting RO/RW keywords on community strings, using the wrong community string for traps, and selecting the wrong NetFlow version. Always verify the exact requirements in the question.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
snmp-server community public RO snmp-server community private RW snmp-server user admin v3group v3 auth sha Cisco123 priv aes 128 Cisco456 snmp-server enable traps snmp-server host 203.0.113.10 version 2c public snmp-server host 203.0.113.10 version 3 auth admin ip flow-export destination 203.0.113.20 2055 ip flow-export version 9
The router lacks SNMP and NetFlow configuration. For SNMP v2c, you must define community strings with 'snmp-server community public RO' and 'snmp-server community private RW'. For SNMP v3, you create a user within a group; the command requires a group name, e.g., 'snmp-server user admin v3group v3 auth sha Cisco123 priv aes 128 Cisco456'. Traps are enabled and sent to 203.0.113.10 via v2c with the public community and v3 with the admin user. NetFlow export uses version 9 to collector 203.0.113.20. Verification commands show SNMP details and flow cache export settings.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
snmp-server community public RO snmp-server community private RW snmp-server user admin v3group v3 auth sha Cisco123 priv aes 128 Cisco456 snmp-server enable traps snmp-server host 203.0.113.10 version 2c public snmp-server host 203.0.113.10 version 3 auth admin ip flow-export destination 203.0.113.20 2055 ip flow-export version 9
Why this is correct
Correctly configures SNMP v2c communities with proper permissions, SNMP v3 user with the required group name (v3group), SHA authentication, and AES-128 encryption, enables traps for both versions with the correct target hosts, and sets NetFlow export to version 9.
- ✗
snmp-server community public snmp-server community private snmp-server user admin v3 auth md5 Cisco123 priv des56 Cisco456 snmp-server enable traps snmp-server host 203.0.113.10 version 2c public snmp-server host 203.0.113.10 version 3 auth admin ip flow-export destination 203.0.113.20 2055 ip flow-export version 9
Why it's wrong here
This configuration is incorrect because it uses MD5 instead of SHA for SNMPv3 authentication and DES instead of AES 128 for encryption. Additionally, the community strings lack the RO and RW keywords, which are required to specify access levels.
- ✗
snmp-server community public RO snmp-server community private RW snmp-server user admin v3 auth sha Cisco123 priv aes 128 Cisco456 snmp-server enable traps snmp-server host 203.0.113.10 version 2c private snmp-server host 203.0.113.10 version 3 auth admin ip flow-export destination 203.0.113.20 2055 ip flow-export version 9
Why it's wrong here
This configuration fails because the SNMPv2c trap receiver at 203.0.113.10 is bound to the 'private' community string, which is the read-write (RW) community. The question explicitly requires a v2c trap host using the read-only (RO) community 'public' to match the monitoring station's read-only access. Sending traps with the RW community violates the least-privilege principle and would be rejected by a properly configured NMS that expects traps from the 'public' community. Additionally, specifying the v2c host with the wrong community string means the NMS may not authenticate the trap, so no alarms would be received.
- ✗
snmp-server community public RO snmp-server community private RW snmp-server user admin v3 auth sha Cisco123 priv aes 128 Cisco456 snmp-server enable traps snmp-server host 203.0.113.10 version 2c public snmp-server host 203.0.113.10 version 3 auth admin ip flow-export destination 203.0.113.20 2055 ip flow-export version 5
Why it's wrong here
The entire SNMP configuration is correct, including the v2c public trap host, v3 user 'admin' with SHA/AES-128, and the trap hosts, but NetFlow export is misconfigured by using version 5 instead of the required version 9. NetFlow version 5 does not support templates, so it cannot carry flexible field definitions or accommodate new flow record formats; version 9 is template-based and allows extensible, structured data export. The question explicitly mandates version 9 for the flow exporter, making version 5 an incorrect choice. Even though the destination 203.0.113.20 and port 2055 are correct, the wrong version breaks the expected flow data encoding and may be unreadable by the collector.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓snmp-server community public RO snmp-server community private RW snmp-server user admin v3group v3 auth sha Cisco123 priv aes 128 Cisco456 snmp-server enable traps snmp-server host 203.0.113.10 version 2c public snmp-server host 203.0.113.10 version 3 auth admin ip flow-export destination 203.0.113.20 2055 ip flow-export version 9Correct answer▾
Why this is correct
Correctly configures SNMP v2c communities with proper permissions, SNMP v3 user with the required group name (v3group), SHA authentication, and AES-128 encryption, enables traps for both versions with the correct target hosts, and sets NetFlow export to version 9.
✗snmp-server community public snmp-server community private snmp-server user admin v3 auth md5 Cisco123 priv des56 Cisco456 snmp-server enable traps snmp-server host 203.0.113.10 version 2c public snmp-server host 203.0.113.10 version 3 auth admin ip flow-export destination 203.0.113.20 2055 ip flow-export version 9Wrong answer — click to see why▾
Why this is wrong here
The specific factual error: SNMPv3 user is configured with MD5 and DES instead of SHA and AES 128; community strings are missing RO/RW keywords.
Why candidates choose this
Candidates might pick this because MD5 and DES are older but still commonly seen in legacy configurations, and they may forget to specify RO/RW for community strings.
✗snmp-server community public RO snmp-server community private RW snmp-server user admin v3 auth sha Cisco123 priv aes 128 Cisco456 snmp-server enable traps snmp-server host 203.0.113.10 version 2c private snmp-server host 203.0.113.10 version 3 auth admin ip flow-export destination 203.0.113.20 2055 ip flow-export version 9Wrong answer — click to see why▾
Why this is wrong here
The specific factual error: The v2c trap host uses 'private' instead of 'public' community string.
Why candidates choose this
Candidates might pick this because they confuse which community string is used for traps; they may think the read-write community is needed for sending traps.
✗snmp-server community public RO snmp-server community private RW snmp-server user admin v3 auth sha Cisco123 priv aes 128 Cisco456 snmp-server enable traps snmp-server host 203.0.113.10 version 2c public snmp-server host 203.0.113.10 version 3 auth admin ip flow-export destination 203.0.113.20 2055 ip flow-export version 5Wrong answer — click to see why▾
Why this is wrong here
The specific factual error: NetFlow export version is set to 5 instead of 9.
Why candidates choose this
Candidates might pick this because version 5 is still widely used and they may not remember that version 9 is required for template-based export.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
Learn chapter
Network Management Approaches: Device, Cloud, Controller, Automation, and IaC
Key term
SNMP
A network protocol used to collect and organize information about managed devices on IP networks and to modify that information to change device behavior.
Key term
Encryption
Encryption is the process of converting readable data into a secret code to prevent unauthorized access.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.