SNMP Enumeration Countermeasures
Which TWO of the following are effective countermeasures against SNMP enumeration attacks? (Select 2)
Quick Answer
The answer is to change default community strings to strong, unique values and restrict SNMP access to trusted IP addresses using ACLs. These two countermeasures directly address the core vulnerability in SNMP enumeration attacks: the use of default “public” and “private” community strings, which act as weak passwords that attackers can guess to query device information. By setting complex, unique strings, you prevent brute-force guessing, while ACLs limit which hosts can even send those queries, effectively shrinking the attack surface. On the Certified Ethical Hacker CEH exam, this topic tests your understanding of network reconnaissance defenses, often appearing in questions that contrast secure configuration with insecure defaults. A common trap is assuming encryption alone suffices—SNMPv3 encryption does not help if weak community strings are still accepted. Remember the mnemonic “Strong Strings, Strict Sources” to recall that both the authentication credential and the network access control must be hardened together.
⚠ Common exam trap
Candidates often select 'Disable SNMP' (option B) as a universal solution, but the CEH exam expects recognition that SNMP is often necessary for monitoring; realistic countermeasures are restrictive ACLs and strong community strings. Also, avoid confusing 'changing community strings' alone as sufficient—ACLs are equally important.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Restrict SNMP access to trusted IP addresses using ACLs
Effective SNMP enumeration countermeasures include (A) restricting SNMP access to trusted IP addresses via ACLs, which prevents unauthorized hosts from querying SNMP agents, and (C) changing default community strings to strong, unique values, making it harder for attackers to guess them. Option B (disabling SNMP) is impractical in many environments because SNMP is needed for network monitoring. Option D (enabling SNMPv3 with default passwords) is ineffective because default passwords are easily guessed. Option E (using SNMPv1 with community string 'private') is the default and well-known, making enumeration trivial. Therefore, A and C are the correct choices.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Restrict SNMP access to trusted IP addresses using ACLs
Why this is correct
Correct: Restricting SNMP access via ACLs limits the attack surface by allowing only trusted IP addresses to query SNMP agents, thwarting enumeration from unauthorized hosts.
- ✗
Disable SNMP on all devices
Why it's wrong here
Incorrect: Disabling SNMP is often impractical as many networks rely on SNMP for monitoring; the question expects realistic countermeasures that balance security and functionality.
- ✓
Change default community strings to strong, unique values
Why this is correct
Correct: Changing default community strings to strong, unique values prevents attackers from easily guessing them, a fundamental defense against SNMP enumeration.
- ✗
Enable SNMPv3 with default passwords
Why it's wrong here
Incorrect: Enabling SNMPv3 with default passwords is not effective; default passwords are easily guessed or known, providing no real security despite the protocol's encryption capabilities.
- ✗
Use SNMPv1 with community string 'private'
Why it's wrong here
Incorrect: Using SNMPv1 with the community string 'private' is a default configuration that attackers know; it offers no security and actually facilitates enumeration.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security auditor runs SNMPwalk against a network device using the default community string 'public' and obtains extensive system information. Which THREE of the following are effective countermeasures to prevent unauthorized SNMP enumeration?
hard- A.Disable SNMP entirely on all devices
- ✓ B.Implement an access control list (ACL) limiting SNMP access to management hosts
- C.Set the community string to 'private' for read-only access
- ✓ D.Change the community string from 'public' to a complex string
- ✓ E.Upgrade SNMP to version 3 with authentication and encryption
Why B: Implementing an access control list (ACL) restricts SNMP queries to only authorized management hosts, preventing unauthorized devices from sending SNMP requests to the network device. Changing the community string from 'public' to a complex, unique string significantly increases the difficulty for attackers to guess the credential for SNMPv1/v2c. Upgrading to SNMP version 3 is the most robust solution as it introduces strong authentication (to verify the identity of the sender) and encryption (to protect the confidentiality of data in transit), addressing the fundamental security weaknesses of earlier SNMP versions.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.