mediumMultiple ChoiceObjective-mapped
Troubleshooting SNMPv3 Authentication Failure Due to Missing ACL
A network engineer notices that an SNMPv3 poll from the NMS to router R1 fails with an authentication error. The engineer has configured 'snmp-server group ADMIN v3 priv' and 'snmp-server user admin ADMIN v3 auth sha cisco123 priv aes 128 cisco456'. The NMS is configured with the same credentials. What is the most likely cause of the failure?
Quick Answer
The answer is a missing ACL on the SNMPv3 group configuration. Even when the username, authentication hash, and privacy protocol match perfectly between the NMS and the router, the `snmp-server group` command requires an `access` clause to explicitly permit the NMS IP address; without it, the router’s default behavior is to deny all SNMP requests, which manifests as an authentication failure in the logs. On the Cisco CCNP ENARSI 300-410 exam, this scenario tests your understanding that SNMPv3 authentication errors are not always credential mismatches—they often stem from access control restrictions, a common trap where engineers focus only on the user configuration. Remember the memory tip: “Group grants access, user grants identity”—if the group lacks an ACL, even a correctly authenticated user is locked out.
⚠ Common exam trap
Candidates often overlook the fact that the group security level must match the NMS's actual request. If the NMS only provides authentication credentials but the group requires privacy, the request fails with an authentication error, leading candidates to focus on password or ACL issues.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The 'priv' keyword in the group definition should be 'auth' instead to match the user's authentication settings.
The SNMP group ADMIN is configured with 'v3 priv', which requires both authentication and encryption. The user admin is correctly configured with authentication and privacy. However, the NMS may be sending only authentication without privacy, which leads to an authentication error because the group expects privacy. The most likely cause is a mismatch between the group's required security level and the NMS's actual request. To resolve this, either the NMS should be configured to use privacy, or the group should be changed to 'v3 auth' to only require authentication. Given the options, changing the group to 'auth' (Option D) would align the group with the NMS's authentication-only behavior, allowing the poll to succeed. Option A is incorrect because the absence of an access-list in the group configuration defaults to permitting all hosts. Option B is incorrect as there is no minimum length requirement beyond 8 characters. Option C is incorrect because the scenario explicitly involves SNMPv3.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The SNMP group is missing the 'access' ACL that permits the NMS IP address.
Why it's wrong here
Correct because SNMPv3 requires an access list on the group to allow the NMS; without it, the NMS is denied despite correct credentials.
- ✗
The SNMP user password must be at least 8 characters; 'cisco123' is only 8, but the hash algorithm requires a minimum of 12 characters.
Why it's wrong here
Incorrect because SNMPv3 passwords do not have a minimum length of 12; 8 characters is acceptable for SHA.
- ✗
The NMS is using SNMPv2c, which is incompatible with SNMPv3 configuration.
Why it's wrong here
Incorrect because the symptom is an authentication error, not a version mismatch; version mismatch would show a different error.
- ✓
The 'priv' keyword in the group definition should be 'auth' instead to match the user's authentication settings.
Why this is correct
Incorrect because 'priv' in the group defines the security level; the user can have 'priv' even if the group is set to 'priv'.
Visual reference
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
This 300-410 question is part of Courseiva's 1,966-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 300-410
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. snmp-server group MyGroup v3 priv\nsnmp-server user MyUser MyGroup v3 auth sha MyPassword priv aes 128 MyPrivKey What is missing from this SNMPv3 configuration?
medium- ✓ A.The group is missing a view definition to allow access to MIB objects.
- B.The authentication protocol should be MD5 instead of SHA.
- C.The privacy password must be at least 16 characters long.
- D.The user must be configured under a different group name.
Why A: The configuration creates an SNMPv3 group 'MyGroup' with priv security level and a user 'MyUser' with SHA authentication and AES 128 privacy, but it does not include a view definition for the group. Without a view (e.g., via the 'snmp-server group MyGroup v3 priv view MyView' command or a default view), the group has no access to any MIB objects, rendering the SNMPv3 configuration non-functional for queries or notifications.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.