- A
Restrict SNMP access to trusted IP addresses using ACLs
ACLs limit which hosts can query SNMP agents.
- B
Disable SNMP on all devices
Why wrong: While effective, it may not be feasible; the question asks for countermeasures, but disabling is not always an option. However, it is a valid countermeasure but not listed as one of the two? Actually, it is listed; the answer expects two correct. Both A and B are effective, but B might be too drastic. The standard answer often includes changing community strings and using ACLs or disabling if not needed. Since the question says 'select 2', and among the options, A and B are commonly recommended. However, the explanation should note that disabling is effective but may impact management. I'll go with A and D as more targeted. Let me review: D says 'Restrict SNMP access...' that's an ACL. B says disable SNMP. Both A and D are specific countermeasures. I'll correct.
- C
Change default community strings to strong, unique values
Default strings like 'public' are well-known; changing them prevents easy enumeration.
- D
Enable SNMPv3 with default passwords
Why wrong: Default passwords still provide weak security; SNMPv3 requires strong authentication, but default passwords are not effective.
- E
Use SNMPv1 with community string 'private'
Why wrong: 'private' is another default community string; using it is insecure.
Quick Answer
The answer is to change default community strings to strong, unique values and restrict SNMP access to trusted IP addresses using ACLs. These two countermeasures directly address the core vulnerability in SNMP enumeration attacks: the use of default “public” and “private” community strings, which act as weak passwords that attackers can guess to query device information. By setting complex, unique strings, you prevent brute-force guessing, while ACLs limit which hosts can even send those queries, effectively shrinking the attack surface. On the Certified Ethical Hacker CEH exam, this topic tests your understanding of network reconnaissance defenses, often appearing in questions that contrast secure configuration with insecure defaults. A common trap is assuming encryption alone suffices—SNMPv3 encryption does not help if weak community strings are still accepted. Remember the mnemonic “Strong Strings, Strict Sources” to recall that both the authentication credential and the network access control must be hardened together.
CEH Enumeration and System Hacking Practice Question
This CEH practice question tests your understanding of enumeration and system hacking. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Which TWO of the following are effective countermeasures against SNMP enumeration attacks? (Select 2)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Restrict SNMP access to trusted IP addresses using ACLs
Restricting SNMP access to trusted IP addresses using ACLs is effective because it limits the attack surface by allowing only authorized management stations to query SNMP agents. This prevents unauthorized hosts from performing SNMP enumeration, even if they know the community string or exploit default configurations.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Restrict SNMP access to trusted IP addresses using ACLs
Why this is correct
ACLs limit which hosts can query SNMP agents.
Related concept
Read the scenario before looking for a memorised answer.
- ✗
Disable SNMP on all devices
Why it's wrong here
While effective, it may not be feasible; the question asks for countermeasures, but disabling is not always an option. However, it is a valid countermeasure but not listed as one of the two? Actually, it is listed; the answer expects two correct. Both A and B are effective, but B might be too drastic. The standard answer often includes changing community strings and using ACLs or disabling if not needed. Since the question says 'select 2', and among the options, A and B are commonly recommended. However, the explanation should note that disabling is effective but may impact management. I'll go with A and D as more targeted. Let me review: D says 'Restrict SNMP access...' that's an ACL. B says disable SNMP. Both A and D are specific countermeasures. I'll correct.
- ✓
Change default community strings to strong, unique values
Why this is correct
Default strings like 'public' are well-known; changing them prevents easy enumeration.
Related concept
Read the scenario before looking for a memorised answer.
- ✗
Enable SNMPv3 with default passwords
Why it's wrong here
Default passwords still provide weak security; SNMPv3 requires strong authentication, but default passwords are not effective.
- ✗
Use SNMPv1 with community string 'private'
Why it's wrong here
'private' is another default community string; using it is insecure.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates may think disabling SNMP is always the best countermeasure, but the CEH exam expects you to recognize that practical environments need SNMP for monitoring, so ACLs and strong community strings are the realistic, effective countermeasures.
Detailed technical explanation
How to think about this question
SNMP enumeration relies on default or weak community strings to walk MIB trees and extract system information. ACLs restrict the source IP addresses that can send SNMP requests, while changing default community strings to strong, unique values prevents attackers from using common strings like 'public' or 'private'. In practice, combining ACLs with SNMPv3 (using strong authentication and encryption) provides defense in depth, but even with SNMPv2c, ACLs and non-default community strings significantly raise the bar for attackers.
KKey Concepts to Remember
- Read the scenario before looking for a memorised answer.
- Find the constraint that changes the correct option.
- Eliminate answers that are true in general but not in this case.
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A security administrator must allow nursing staff to reach a patient records server while blocking access from the guest Wi-Fi VLAN. After applying an extended ACL, traffic is still blocked from nursing workstations. The ACL was applied outbound instead of inbound on the wrong interface. Questions like this test ACL direction and placement rules.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
- →
Enumeration and System Hacking — study guide chapter
Learn the concepts, then practise the questions
- →
Enumeration and System Hacking practice questions
Targeted practice on this topic area only
- →
All CEH questions
1,010 questions across all exam domains
- →
Certified Ethical Hacker CEH study guide
Full concept coverage aligned to exam objectives
- →
CEH practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Related CEH practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Footprinting, Reconnaissance and Scanning practice questions
Practise CEH questions linked to Footprinting, Reconnaissance and Scanning.
Enumeration and System Hacking practice questions
Practise CEH questions linked to Enumeration and System Hacking.
Malware, Social Engineering and Network Attacks practice questions
Practise CEH questions linked to Malware, Social Engineering and Network Attacks.
Web Application and Injection Attacks practice questions
Practise CEH questions linked to Web Application and Injection Attacks.
Introduction to Ethical Hacking practice questions
Practise CEH questions linked to Introduction to Ethical Hacking.
Scanning Networks and Enumeration practice questions
Practise CEH questions linked to Scanning Networks and Enumeration.
Vulnerability Analysis and System Hacking practice questions
Practise CEH questions linked to Vulnerability Analysis and System Hacking.
Advanced Topics: Wireless, Cloud, IoT, Cryptography practice questions
Practise CEH questions linked to Advanced Topics: Wireless, Cloud, IoT, Cryptography.
Footprinting and Reconnaissance practice questions
Practise CEH questions linked to Footprinting and Reconnaissance.
Network and Web Application Attacks practice questions
Practise CEH questions linked to Network and Web Application Attacks.
Wireless, IoT and Cloud Security practice questions
Practise CEH questions linked to Wireless, IoT and Cloud Security.
Cryptography and Malware Analysis practice questions
Practise CEH questions linked to Cryptography and Malware Analysis.
Practice this exam
Start a free CEH practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this CEH question test?
Enumeration and System Hacking — This question tests Enumeration and System Hacking — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Restrict SNMP access to trusted IP addresses using ACLs — Restricting SNMP access to trusted IP addresses using ACLs is effective because it limits the attack surface by allowing only authorized management stations to query SNMP agents. This prevents unauthorized hosts from performing SNMP enumeration, even if they know the community string or exploit default configurations.
What should I do if I get this CEH question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more ways this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security auditor runs SNMPwalk against a network device using the default community string 'public' and obtains extensive system information. Which THREE of the following are effective countermeasures to prevent unauthorized SNMP enumeration?
hard- A.Disable SNMP entirely on all devices
- ✓ B.Implement an access control list (ACL) limiting SNMP access to management hosts
- C.Set the community string to 'private' for read-only access
- ✓ D.Change the community string from 'public' to a complex string
- ✓ E.Upgrade SNMP to version 3 with authentication and encryption
Why B: Options A, C, and D are correct. Changing default community strings is a basic step. Using SNMPv3 provides encryption and authentication. Restricting SNMP access to specific IP addresses reduces exposure. B and E are incorrect as they increase risk or are unrelated.
Last reviewed: Jun 24, 2026
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.