mediumMultiple ChoiceObjective-mapped
350-401 Practice Question: Configures SNMPv2c on a Cisco switch to send…
A network engineer configures SNMPv2c on a Cisco switch to send traps to an NMS at 192.168.1.100 with community 'monitor'. The engineer also configures 'snmp-server enable traps snmp linkdown linkup'. The NMS receives link traps but not authentication failure traps. The engineer has not configured any access control. What is the most likely reason?
⚠ Common exam trap
Cisco often tests the fact that authentication failure traps are a separate sub-option under 'snmp-server enable traps snmp' and are not enabled by default, leading candidates to assume that enabling 'snmp-server enable traps snmp' covers all SNMP-related traps.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Authentication failure traps are disabled by default and must be explicitly enabled.
On Cisco IOS, authentication failure traps are not enabled by default even when 'snmp-server enable traps snmp' is configured. The engineer explicitly enabled 'linkdown' and 'linkup' traps, but authentication failure traps require the additional keyword 'authentication' in the 'snmp-server enable traps snmp' command. Without this, the switch will not generate SNMP authenticationFailure notifications (RFC 1157) when an SNMP request uses an invalid community string.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Authentication failure traps are disabled by default and must be explicitly enabled.
Why this is correct
Correct because 'snmp-server enable traps snmp authentication' is needed to send authentication failure traps.
- ✗
The NMS is not configured to receive authentication failure traps.
Why it's wrong here
Incorrect because the NMS receives other traps; the issue is on the switch.
- ✗
The community string 'monitor' has read-write access, which suppresses authentication traps.
Why it's wrong here
Incorrect because community string access level does not affect trap generation.
- ✗
The switch must be configured with 'snmp-server trap-source' to send authentication traps.
Why it's wrong here
Incorrect because trap-source is for source interface, not for enabling specific traps.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-401 question from scratch — 1,175 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.