hardMultiple ChoiceObjective-mapped
300-410 Practice Question: Router R5 is configured with SNMPv3 for secure…
Router R5 is configured with SNMPv3 for secure management. The configuration includes: snmp-server group mygroup v3 priv, snmp-server user myuser mygroup v3 auth sha myauth priv aes 128 mypriv. The NMS is configured with the same credentials. However, the NMS cannot poll R5. The debug snmp packet shows: 'Authentication failure'. The NMS and R5 have correct time synchronization via NTP. What is the root cause?
⚠ Common exam trap
Cisco often tests the distinction between authentication failures (caused by credential or protocol mismatches) and other SNMPv3 errors like engine ID mismatches or time synchronization issues, leading candidates to overlook the specific debug message wording.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The NMS is configured to use MD5 authentication, but the router is configured with SHA.
The debug output shows 'Authentication failure', which indicates that the SNMPv3 authentication credentials do not match between the NMS and the router. The router is configured with 'auth sha' for the user 'myuser', but the NMS is using MD5 authentication. Since SNMPv3 requires an exact match of the authentication protocol (SHA vs. MD5) and the associated passphrase, this mismatch causes the authentication failure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The NMS is configured to use MD5 authentication, but the router is configured with SHA.
Why this is correct
SNMPv3 authentication failure occurs if the authentication protocol mismatches. The debug shows authentication failure, not privacy, so the issue is auth protocol mismatch.
- ✗
The SNMP engine ID on the router has changed due to a hardware replacement, causing the NMS to have a stale engine ID.
Why it's wrong here
A stale engine ID would cause a different error, such as 'unknown engine ID', not authentication failure.
- ✗
The NMS is using SNMPv2c community string instead of SNMPv3.
Why it's wrong here
This would cause a different debug message, not authentication failure. The NMS is configured for v3 per the scenario.
- ✗
The router's clock is not synchronized with NTP, causing authentication key mismatch.
Why it's wrong here
The scenario states time synchronization is correct via NTP, so this is not the issue.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
Courseiva writes every 300-410 question from scratch — 1,966 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.