Network Operations →mediumMultiple ChoiceObjective-mapped

N10-009 Network Operations Practice Question

A network administrator has configured SNMPv3 on a router to send traps to a central management server. The administrator notices that no traps are being received. The management server is reachable via ping from the router. Which configuration step is most likely missing?

⚠ Common exam trap

CompTIA often tests the misconception that SNMPv3 still requires a community string or that simply setting a trap destination is sufficient, when in fact the security credentials must be explicitly configured and matched on both devices.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Configure SNMPv3 authentication and privacy credentials on both the router and the server

SNMPv3 requires authentication and encryption (privacy) to be configured on both the router and the management server. Without matching credentials, the server will reject or ignore the traps, even if the network path is reachable. This is the most likely missing step because SNMPv3 does not use community strings and relies on security models (authNoPriv, authPriv, or noAuthNoPriv) that must be consistent between endpoints.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Configure the SNMP community string on the router
Why it's wrong here
This option is incorrect because SNMPv3 explicitly replaces the insecure community string mechanism used by SNMPv1 and SNMPv2c. Community strings act as a simple, unauthenticated password for read-only or read-write access in older SNMP versions. SNMPv3, however, employs a user-based security model with cryptographic authentication and encryption, rendering community strings entirely irrelevant and ineffective for securing its communications.
When this WOULD be correct
This would be correct in a question about SNMPv1 or v2c where traps are not being received, and the community string on the router does not match the server's expected community string.
✗
Set the SNMP trap destination IP address on the router
Why it's wrong here
The trap destination must be set for traps to be sent, but the administrator likely already did this since the router is sending traps, just not being received. The question indicates no traps are received, implying missing credentials.
When this WOULD be correct
This would be correct in a scenario where the administrator configured SNMPv2c traps but forgot to specify the trap receiver's IP address, and no traps are received despite the server being reachable.
✓
Configure SNMPv3 authentication and privacy credentials on both the router and the server
Why this is correct
This is the correct answer because SNMPv3, unlike its predecessors, incorporates robust security features. For traps to be successfully sent by the router and subsequently accepted and processed by the management server, both devices must be configured with identical authentication protocols (e.g., MD5, SHA) and privacy protocols (e.g., DES, AES) along with their respective keys. Without this precise credential matching, the server will discard the encrypted traps due to authentication failure or inability to decrypt the payload, preventing any reception.
✗
Ensure the SNMP agent is enabled on the router
Why it's wrong here
While an enabled SNMP agent is a fundamental prerequisite for any SNMP operation, this option is unlikely the primary cause of traps not being *received* by the server in an SNMPv3 context. The question implies the router is *attempting* to send traps, suggesting the agent is active. The specific problem of non-reception, particularly with SNMPv3, almost always points to a security mismatch rather than a disabled agent, as a disabled agent would prevent traps from even being generated or sent.
When this WOULD be correct
In a scenario where a network administrator has configured SNMPv2c with a community string but no traps are received, and the management server is reachable, the missing step could be ensuring the SNMP agent is enabled (e.g., via 'snmp-server enable traps' command).

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.

✓Configure SNMPv3 authentication and privacy credentials on both the router and the serverCorrect answer▾

Why this is correct

This is the correct answer because SNMPv3, unlike its predecessors, incorporates robust security features. For traps to be successfully sent by the router and subsequently accepted and processed by the management server, both devices must be configured with identical authentication protocols (e.g., MD5, SHA) and privacy protocols (e.g., DES, AES) along with their respective keys. Without this precise credential matching, the server will discard the encrypted traps due to authentication failure or inability to decrypt the payload, preventing any reception.

✗Configure the SNMP community string on the routerWrong answer — click to see why▾

Why this is wrong here

SNMPv3 does not use community strings; they are only for SNMPv1/v2c. The question specifies SNMPv3, so configuring a community string is irrelevant and will not resolve the trap delivery issue.

★ When this WOULD be the correct answer

This would be correct in a question about SNMPv1 or v2c where traps are not being received, and the community string on the router does not match the server's expected community string.

Why candidates choose this

Candidates often confuse SNMPv3 with earlier versions and default to community string configuration, not realizing SNMPv3 uses usernames and authentication/privacy settings instead.

✗Set the SNMP trap destination IP address on the routerWrong answer — click to see why▾

Why this is wrong here

The trap destination IP address is a required step, but the question states that the management server is reachable via ping, implying the destination is already set. The issue is likely authentication mismatch, not missing destination.

★ When this WOULD be the correct answer

This would be correct in a scenario where the administrator configured SNMPv2c traps but forgot to specify the trap receiver's IP address, and no traps are received despite the server being reachable.

Why candidates choose this

Candidates often assume that setting the trap destination is the most common missing step, overlooking that SNMPv3 requires matching credentials for communication.

✗Ensure the SNMP agent is enabled on the routerWrong answer — click to see why▾

Why this is wrong here

The SNMP agent is enabled by default on most routers when SNMP is configured, and the question states that SNMPv3 has been configured, implying the agent is active. The issue is likely mismatched authentication and privacy settings, not a disabled agent.

★ When this WOULD be the correct answer

In a scenario where a network administrator has configured SNMPv2c with a community string but no traps are received, and the management server is reachable, the missing step could be ensuring the SNMP agent is enabled (e.g., via 'snmp-server enable traps' command).

Why candidates choose this

Candidates may think that enabling the SNMP agent is a separate, often overlooked step, especially when moving from SNMPv2c to SNMPv3, but in SNMPv3 configuration, the agent is typically enabled automatically when traps are configured.

Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

N10-009 Network Operations Practice Question

Why each option matters

Option-by-option breakdown

Why each answer is right or wrong

Related to this question