hardMultiple Choice
Troubleshoot SNMPv3 Walk Failure: Group Not Associated with View | Cisco ENCOR
A network engineer configures SNMPv3 on a Cisco router with the following: 'snmp-server group GRP v3 priv', 'snmp-server user usr GRP v3 auth sha pass1 priv aes 128 pass2'. The NMS is configured with the same credentials. However, the NMS cannot perform SNMP walks. The engineer notices that the router's SNMP agent is responding to queries from other devices. What is the most likely cause?
Quick Answer
The answer is that the SNMPv3 group 'GRP' is not associated with a view that permits read access to the MIB tree, which directly causes the SNMPv3 walk failure. Even with correct authentication and encryption configured for the user and group, the SNMP agent will deny walk requests if the group lacks a view definition that includes the OIDs being traversed; by default, a group may have no view or only a restricted view, blocking bulk retrieval. On the ENCOR 350-401 exam, this scenario tests your understanding that SNMPv3 security is layered—credentials alone are insufficient without explicit view configuration, and a common trap is assuming that a working query from other devices proves the SNMP agent is fully functional, when in fact those devices may use a different group with a proper view. Remember the mnemonic: "Group without a view is a walk that won't get through."
⚠ Common exam trap
Cisco often tests the misconception that configuring SNMPv3 with authentication and privacy alone is sufficient for access, when in fact a view must be explicitly assigned to the group to allow read operations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The group 'GRP' is not associated with a view that allows read access to the MIB tree.
The 'snmp-server group GRP v3 priv' command creates an SNMPv3 group with privacy (encryption) but does not associate it with any view. By default, SNMPv3 groups have no read, write, or notify access unless a view is explicitly configured. Without a view that permits read access to the MIB tree, the NMS cannot perform SNMP walks, even though the router responds to other queries (e.g., from different groups or versions).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The user's authentication key is too short.
Why it's wrong here
SHA authentication accepts keys of eight characters or more, and pass1 satisfies that minimum, so length is not the fault. Short keys cause errors when the configured passphrase falls below the algorithm's minimum, which the stem's credentials do not.
- ✓
The group 'GRP' is not associated with a view that allows read access to the MIB tree.
Why this is correct
Without a view clause, the group has no MIB access rights, so the agent silently drops or rejects the NMS's authenticated requests despite valid SHA/AES credentials. Other devices succeed because their groups map to views permitting read access, satisfying the walk requirement.
- ✗
The NMS is using SNMPv2c community strings instead of SNMPv3.
Why it's wrong here
The stem confirms the NMS is configured with matching SNMPv3 credentials, so it is not falling back to v2c community strings. Community-string mismatch is the usual culprit when an NMS was never migrated to SNMPv3, but here v3 parameters were already applied.
- ✗
The router's SNMP engine ID has changed since the user was created.
Why it's wrong here
A changed engine ID invalidates the user's localised authentication and privacy keys, but the stem states other devices query the agent successfully, so the engine ID is unchanged. Engine-ID mismatch is the classic cause when every SNMPv3 manager fails after a device rebuild or config restore.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-401 question from scratch — 1,923 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 350-401
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Given the following SNMPv3 configuration on a Cisco IOS-XE router: snmp-server group ADMIN v3 priv write ADMINVIEW snmp-server user admin ADMIN v3 auth sha cisco123 priv aes 128 cisco456 snmp-server view ADMINVIEW iso included What is missing or incorrect in this configuration?
medium- A.The SNMPv3 user 'admin' must also specify an engine ID for the router.
- ✓ B.The view 'ADMINVIEW' includes the entire ISO tree, which might be too permissive for a restricted write view.
- C.The privacy password 'cisco456' must be at least 8 characters long.
- D.The group 'ADMIN' must be configured with a read view to allow SNMP get operations.
Why B: The view 'ADMINVIEW' is configured with 'iso included', which includes the entire ISO OID tree. This grants write access to all MIB objects, which is overly permissive for a restricted write view. In SNMPv3, a write view should be limited to specific OIDs or subtrees to enforce least privilege, and including the entire ISO tree violates that principle. Option D is incorrect because a read view is not required if the group is only intended for write operations. The configuration as shown only specifies a write view, which is sufficient for SNMP set operations. Adding a read view is optional and not a mandatory missing piece.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.