mediumMultiple Choice
300-410 Practice Question: Is troubleshooting a router that is not…
A network engineer is troubleshooting a router that is not responding to SNMP polls from the NMS at 10.1.1.100. The SNMP configuration includes 'snmp-server community public RO' and 'snmp-server community private RW'. The engineer can ping the router from the NMS. 'show snmp' shows SNMP is enabled. What is the most likely cause?
⚠ Common exam trap
Cisco often tests the distinction between reachability (ping working) and SNMP-specific filtering (ACL on community), leading candidates to incorrectly blame community string mismatch or SNMP version when the real issue is an access-list silently dropping SNMP packets.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An ACL is applied to the SNMP community that denies the NMS IP.
The NMS can ping the router, confirming IP reachability, and 'show snmp' confirms SNMP is enabled. The most likely cause is an ACL applied to the SNMP community that denies the NMS IP address (10.1.1.100). Cisco IOS allows an access-list to be attached to an SNMP community string using the 'snmp-server community <string> [RO|RW] <acl-number>' command, which filters SNMP requests based on source IP. Since the NMS can ping but not poll, the ACL is blocking SNMP traffic while permitting ICMP.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The NMS is using the wrong SNMP version.
Why it's wrong here
SNMPv3 polling against an agent configured only with v1/v2c community strings fails, since v3 requires a user, authentication and encryption configuration absent here. It is tempting because version mismatch genuinely breaks polling, but the stem gives no evidence of the NMS version, and an ACL blocking 10.1.1.100 would equally explain silence.
- ✓
An ACL is applied to the SNMP community that denies the NMS IP.
Why this is correct
An ACL bound to the community string filters incoming SNMP requests by source address, so a deny entry for 10.1.1.100 silently drops polls despite ICMP succeeding and SNMP being enabled. This satisfies the stem's constraint that reachability is proven yet polling fails, isolating the fault to community-level access control rather than transport or service state.
- ✗
The router's SNMP agent is disabled due to high CPU.
Why it's wrong here
High CPU does not disable the SNMP agent; the router would still answer polls, perhaps slowly. It is tempting because overloaded devices drop management traffic, but 'show snmp' confirms the agent is running, and an ACL denying the NMS address is the mechanism that would actually block replies.
- ✗
The NMS is using the wrong community string.
Why it's wrong here
The NMS can ping the router and SNMP is enabled, so reachability and service state are fine; a wrong community string would still cause the poll to fail authentication. It is tempting because community mismatches are a common SNMP fault, and would be correct if polling failed while ping succeeded with no other cause.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 300-410 question from scratch — 1,401 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.