CCNA Snmp Questions

Option A is incorrect because SNMPv3 supports both IPv4 and IPv6 networks. It is not limited to IPv4 only, so this option misrepresents SNMPv3’s capabilities.

Option C is incorrect since SNMPv3 continues to support monitoring functions such as interface counters. It does not remove or restrict these capabilities.

Option D is incorrect because SNMPv3 does not replace syslog. Both protocols coexist and serve different roles in network management and logging.

SNMPv3 provides significantly higher security than SNMPv2c by adding authentication and encryption, whereas SNMPv2c uses only community strings in clear text. Both versions support traps, so the statement incorrectly claims SNMPv3 has additional trap support, which is not a distinguishing feature.

SNMPv2c supports GET, SET, and trap operations, just like SNMPv1 and SNMPv3. The statement is incorrect because it claims SNMPv2c does not support traps, which is false; traps are a key feature for asynchronous notifications in network monitoring.

SNMPv3 uses the User-based Security Model (USM) with usernames and authentication keys, not community strings. Community strings are a feature of SNMPv1 and SNMPv2c, which are transmitted in clear text and provide weak security.

The specific factual error: SNMPv3 user is configured with MD5 and DES instead of SHA and AES 128; community strings are missing RO/RW keywords.

The specific factual error: The v2c trap host uses 'private' instead of 'public' community string.

The specific factual error: NetFlow export version is set to 5 instead of 9.

The group level 'auth' does not permit encryption; 'priv' is required for AES-128 encryption.

The encryption algorithm specified is DES (56-bit) instead of AES-128.

NetFlow export version is 5, not 9 as required.

The configuration omits the 'ip flow ingress' (or any) interface command, so NetFlow will not collect any traffic.

The 'ip flow egress' command monitors outbound traffic, not the specified inbound traffic on GigabitEthernet0/0.

The 'ip flow monitor FLOW-MONITOR input' command references a flexible NetFlow monitor that does not exist; traditional 'ip flow ingress' is required.

Many believe SNMP requires an additional global command to start; on Cisco IOS, a community string entry enables the agent.

Polling failures are often attributed to community string errors, but when the string matches, an ACL restriction produces identical symptoms.

Candidates may assume the agent must be bound to an interface, but Cisco IOS SNMP agents respond on any interface unless limited by an ACL or VRF.

The trap host line uses 'version 3' and a community string ('public'), but SNMPv3 traps require a security name (the user) and an authentication level, not a community.

The SNMPv3 user is configured with MD5 and DES56, while the requirement is SHA authentication and AES 128‑bit encryption.

The NetFlow export version is set to 5 instead of the required version 9.

A DHCP scope handles address assignment and has no role in traffic conversation visibility.

An STP priority manages spanning-tree topology and does not provide bandwidth usage details.

A larger OSPF metric affects routing path selection but does not reveal which conversations are using bandwidth.

Syslog severity 7 refers to debug-level logging detail but does not trigger unsolicited alerts; syslog messages require polling or log monitoring and are not part of SNMP's event-driven notification.

DHCP relay is a mechanism to forward DHCP requests across networks and has no role in SNMP or event-driven notifications, making it irrelevant to the question.

NetFlow exporters provide detailed traffic flow information for analysis but do not send immediate event notifications; they are unrelated to SNMP traps or polling mechanisms.

The 'restrict' mode allows frames from unauthorized MAC addresses to be dropped while sending SNMP traps and syslog messages, which contradicts the requirement of keeping the interface up without notifications.

The 'shutdown' mode disables the interface when a violation occurs, which is contrary to the requirement of keeping the interface up. It also does not align with the need to drop frames without sending SNMP traps or syslog messages.

The 'shutdown vlan' mode disables the entire VLAN when a violation occurs, which is not aligned with the requirement to keep the interface up. This option also typically sends SNMP traps or syslog messages, which contradicts the question's criteria.

The group keyword 'auth' only enables authentication, not encryption. AES 128 requires the 'priv' keyword.

The 'snmp-server user' command requires a group name. Omitting the group will result in an error or incomplete configuration.

The command 'ip flow-export destination' sets the collector IP and port, not the export version. The version is set with 'ip flow-export version 9'.

Missing the required SNMPv3 group and relies on the deprecated interface command 'ip flow export' instead of the modern flow monitor method.

Lacks the required global flow monitor definition block; the 'ip flow monitor' command on the interface refers to a nonexistent monitor.

Places the flow monitor definition commands inside the interface configuration context, where they would be rejected as invalid.

The question explicitly requires NetFlow version 9, and traffic monitoring must be limited to the 10.10.10.0/24 network.

Enabling all traps is unnecessary and may cause unwanted overhead; the flow monitor must be applied to the correct interface(s) based on traffic flow, not the network address.

NetFlow requires a flow monitor to be applied to an interface to capture traffic; it does not automatically monitor all traffic.

Adding another SSID is incorrect because it only creates a new wireless network segment and does not provide any traffic flow or bandwidth usage information. It does not help identify which applications or hosts are using the link.

PortFast is an STP feature that speeds up port transitions on edge ports but does not monitor or analyze traffic flows. It has no relevance to identifying bandwidth usage or application-level visibility.

Using a larger wildcard mask in ACLs affects traffic filtering rules but does not provide analytics or visibility into traffic flows. ACLs do not report on bandwidth consumption or application usage.

The specific factual error: The SNMP trap destination and NetFlow export destination are swapped, and the flow direction is egress instead of ingress.

The specific factual error: SNMP traps should use the read-only community string 'public', not the read-write 'private'.

The specific factual error: NetFlow export version is set to 5, but the requirement is version 9.

Logging trap level controls which severity messages are forwarded, not the accuracy of the timestamps.

SNMP v3 misconfiguration impacts SNMP traps, not syslog messages, which are sent independently via a different transport.

Cache timeout affects flow export frequency, not the accuracy of the timestamps inside the flow data.