Snmp practice questions

IP address exhaustion

Why wrong: STP does not address IP address planning.

Slow DNS lookups

Why wrong: DNS performance is unrelated to STP.

Weak wireless encryption

Why wrong: Wireless encryption is unrelated to STP.

SNMP

Why wrong: The AI agent is the autonomous entity that makes decisions, but it does not directly interact with external systems without a tool-calling mechanism.

CLI scripting

Why wrong: Closed-loop remediation is the overall process of detecting, analyzing, and fixing issues automatically, but it does not specify how the agent interacts with external systems.

Syslog

Why wrong: Prompt engineering involves crafting inputs to guide the AI model's responses, but it does not enable the agent to execute commands or query devices.

snmp-server community NetOpsRO ro snmp-server user AdminUser v3 auth sha AuthPass1 priv aes 128 PrivPass2 snmp-server enable traps snmp-server host 192.0.2.10 TrapComm flow exporter EXPORTER destination 192.0.2.20 version 9 ! interface GigabitEthernet0/0 ip flow export EXPORTER

Why wrong: This is incorrect because the SNMPv3 user is created without a group, which is required for authentication and privacy privileges. Also, 'ip flow export' is not a valid interface command; the correct command is 'ip flow monitor' referencing a flow monitor that uses the exporter.

snmp-server community NetOpsRO ro snmp-server group AdminGroup v3 priv snmp-server user AdminUser AdminGroup v3 auth sha AuthPass1 priv aes 128 PrivPass2 snmp-server enable traps snmp-server host 192.0.2.10 version 2c TrapComm flow exporter EXPORTER destination 192.0.2.20 version 9 ! interface GigabitEthernet0/0 ip flow monitor FLOW-MONITOR input

Why wrong: This is incorrect because the 'snmp-server host' command includes 'version 2c', which forces traps to be sent using SNMPv2c with the community string. However, the trap community 'TrapComm' is specified, but the command syntax is correct; the error is that the trap destination should not specify version 2c if the community is intended for v2c traps, but the question does not specify version, so it's acceptable. Actually, the main error is missing the flow exporter reference in the flow monitor; the flow monitor must be configured with the exporter. The given config does not show the flow monitor configuration.

snmp-server community NetOpsRO ro snmp-server group AdminGroup v3 priv snmp-server user AdminUser AdminGroup v3 auth sha AuthPass1 priv aes 128 PrivPass2 snmp-server enable traps snmp-server host 192.0.2.10 TrapComm flow exporter EXPORTER destination 192.0.2.20 version 9 ! interface GigabitEthernet0/0 ip flow monitor FLOW-MONITOR input flow monitor FLOW-MONITOR exporter EXPORTER

Why wrong: This is incorrect because the flow monitor configuration is placed after the interface command, which is out of order. The flow monitor must be configured before it is applied to the interface. Additionally, the 'flow monitor' command should be in global configuration mode, not after the interface command.

restrict

Why wrong: Restrict provides similar forwarding behavior but tracks and reports violations.

shutdown

Why wrong: Shutdown places the port into err-disabled state after a violation.

shutdown vlan

Why wrong: Shutdown vlan is not the standard switchport port-security violation mode being tested here.

Always deny all IP traffic to the destination subnet first.

Why wrong: This is wrong because it may overblock beyond the requirement.

Use a standard ACL because destination details never matter.

Why wrong: This is wrong because destination detail matters greatly in this scenario.

Place the ACL only where no routing exists.

Why wrong: This is wrong because the key issue here is match precision, not that rule.

snmp-server community public snmp-server community private snmp-server user admin v3 auth md5 Cisco123 priv des56 Cisco456 snmp-server enable traps snmp-server host 203.0.113.10 version 2c public snmp-server host 203.0.113.10 version 3 auth admin ip flow-export destination 203.0.113.20 2055 ip flow-export version 9

Why wrong: This configuration is incorrect because it uses MD5 instead of SHA for SNMPv3 authentication and DES instead of AES 128 for encryption. Additionally, the community strings lack the RO and RW keywords, which are required to specify access levels.

snmp-server community public RO snmp-server community private RW snmp-server user admin v3 auth sha Cisco123 priv aes 128 Cisco456 snmp-server enable traps snmp-server host 203.0.113.10 version 2c private snmp-server host 203.0.113.10 version 3 auth admin ip flow-export destination 203.0.113.20 2055 ip flow-export version 9

Why wrong: This configuration incorrectly uses the private community string for the v2c trap host. The v2c trap host should use the read-only community string 'public' as specified in the question, not the read-write 'private'.

snmp-server community public RO snmp-server community private RW snmp-server user admin v3 auth sha Cisco123 priv aes 128 Cisco456 snmp-server enable traps snmp-server host 203.0.113.10 version 2c public snmp-server host 203.0.113.10 version 3 auth admin ip flow-export destination 203.0.113.20 2055 ip flow-export version 5

Why wrong: This configuration incorrectly uses NetFlow version 5 instead of version 9. The question explicitly requires version 9, which supports templates and is more flexible than the older version 5.

snmp-server host 10.1.1.200 version 2c private snmp-server enable traps ip flow-export destination 10.1.1.100 2055 version 9 ip flow-export source Loopback0 interface GigabitEthernet0/0 ip flow egress

Why wrong: This configuration is incorrect because the trap destination is set to the NetFlow collector (10.1.1.200) instead of the management server (10.1.1.100), and the NetFlow export destination is set to the management server instead of the collector. Additionally, NetFlow should be configured as ingress, not egress.

snmp-server host 10.1.1.100 version 2c private snmp-server enable traps ip flow-export destination 10.1.1.200 2055 version 9 ip flow-export source Loopback0 interface GigabitEthernet0/0 ip flow ingress

Why wrong: This configuration uses the read-write community string 'private' for SNMP traps instead of the read-only 'public'. While the trap destination and NetFlow settings are correct, the community string must match the read-only community for traps.

snmp-server host 10.1.1.100 version 2c public snmp-server enable traps snmp linkdown linkup ip flow-export destination 10.1.1.200 2055 version 5 ip flow-export source Loopback0 interface GigabitEthernet0/0 ip flow ingress

Why wrong: This configuration uses NetFlow version 5 instead of version 9. The question explicitly requires version 9. All other settings are correct.

Configure the interface with `switchport mode trunk`

Why wrong: This is wrong because a trunk is intended to carry multiple VLANs.

Configure the interface with `switchport mode dynamic desirable`

Why wrong: This is wrong because it still involves trunk negotiation behavior.

Configure the interface with `no switchport`

Why wrong: This is wrong because that converts the interface to routed-port behavior on supported devices.

switchport trunk allowed vlan 10

Why wrong: This is wrong because it modifies a trunk’s allowed VLAN list, not access mode.

switchport mode dynamic desirable

Why wrong: This is wrong because it is a negotiation-related setting, not a direct access-mode command.

no switchport

Why wrong: This is wrong because it converts the interface to Layer 3 routed-port behavior on supported devices.

switchport access vlan 10

Why wrong: This is wrong because it assigns an access VLAN and does not place the interface into trunking mode.

switchport mode dynamic auto

Why wrong: This is wrong because dynamic auto relies on negotiation and does not directly force trunking.

spanning-tree portfast

Why wrong: This is wrong because PortFast is an STP feature for edge ports, not a trunk-mode command.

Another DHCP scope

Why wrong: This is wrong because DHCP scopes do not explain bandwidth conversations.

A new STP priority

Why wrong: This is wrong because STP priority is unrelated to traffic-conversation visibility.

A larger OSPF metric

Why wrong: This is wrong because OSPF metrics do not identify which flows are consuming bandwidth.

BPDU Guard is enabled on the port, causing it to be placed in error-disabled state.

Why wrong: BPDU Guard would immediately error-disable a port if any BPDU is received, typically used on PortFast-enabled access ports. It does not react to a loss of BPDUs and would not produce a loop-inconsistent state.

UDLD has detected a unidirectional link and has shut down the port.

Why wrong: UDLD (UniDirectional Link Detection) can detect one-way link failures on fiber connections and will place the port in an err-disabled state or shut it down, not in a loop-inconsistent state. Loop-inconsistent is specific to STP Loop Guard.

Root Guard is preventing the port from transitioning to designated forwarding after losing BPDUs.

Why wrong: Root Guard is configured on designated ports to enforce the root bridge placement by blocking a port that receives superior BPDUs. It does not react to a loss of BPDUs on a root port, nor does it produce a loop-inconsistent state.

SNMPv2c is not enabled on the router.

Why wrong: Configuring an SNMP community string implicitly enables the SNMP agent for that version. The question states the community is configured, so the agent is active.

The NMS is using the wrong community string.

Why wrong: Both the router and NMS use 'public', so the community string is correct. The ACL, not a mismatch, causes the polls to fail.

The router's SNMP agent is not listening on the interface facing 10.1.1.200.

Why wrong: By default, the SNMP agent listens on all IP interfaces. No configuration indicates interface-specific restrictions, so this is unlikely.

Verify that R3 has a route back to R1’s subnet.

Why wrong: If R3 were missing a route to R1’s subnet, it would not be able to send reply packets to R1. However, R2 and R1 typically reside in the same stub network (e.g., 10.1.1.0/24). The fact that R2 can ping R3 successfully proves that R3 already has a working return path to that network via R2. Checking the routing table at this stage duplicates a condition that is already indirectly verified.

Verify the OSPF neighbor adjacency between R2 and R3.

Why wrong: R2’s successful ping to R3 relies on proper routing, which in turn depends on OSPF if dynamic routing is used. A failed adjacency would prevent R2 from reaching R3’s loopback or connected interface, so the ping from R2 would also fail. Thus, the OSPF adjacency is already proven to be functional.

Test for an MTU mismatch along the path from R1 to R3.

Why wrong: An MTU mismatch typically causes problems only with large packets, while small pings (the default ICMP echo size) succeed. In this scenario, standard-sized pings from R1 time out entirely, and pings from R2 succeed, which is inconsistent with an MTU issue. Furthermore, an MTU problem would affect all traffic over the path, not just traffic from a specific source.

A standard static route with the default administrative distance of 1

Why wrong: This is wrong because a default static route distance of 1 would override OSPF instead of floating behind it.

Removing OSPF entirely and using only a default route

Why wrong: This is wrong because it changes the primary design rather than preserving OSPF as the normal path.

Disabling the routing table on the router until failure occurs

Why wrong: This is wrong because routers do not work by disabling the routing table to create backup behavior.