easyMultiple ChoiceObjective-mapped
300-410 Practice Question: Which SNMPv3 security model provides both…
Which SNMPv3 security model provides both authentication and encryption by default?
⚠ Common exam trap
Cisco often tests the distinction between USM (which handles authentication and encryption) and VACM (which handles authorization and access control), leading candidates to mistakenly select VACM when asked about authentication and encryption.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
User-based Security Model (USM) with authPriv
SNMPv3 defines three security levels: noAuthNoPriv, authNoPriv, and authPriv. The User-based Security Model (USM) with the authPriv security level provides both authentication (using HMAC-MD5 or HMAC-SHA) and encryption (using CBC-DES or CFB-AES). This is the only default combination within SNMPv3 that offers both services, making option B correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Community-based Security Model (CSM)
Why it's wrong here
CSM is used in SNMPv1/v2c, not v3; it does not provide encryption.
- ✓
User-based Security Model (USM) with authPriv
Why this is correct
USM with authPriv provides both authentication and encryption (privacy).
- ✗
View-based Access Control Model (VACM)
Why it's wrong here
VACM controls access to MIB objects, not authentication or encryption.
- ✗
Transport Layer Security (TLS) model
Why it's wrong here
TLS is not a standard SNMPv3 security model; USM is the default.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
Courseiva writes every 300-410 question from scratch — 1,966 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.