NSE4 System and Network Administration Practice Question
An administrator wants to configure SNMPv3 on a FortiGate for secure monitoring. Which configuration is required?
⚠ Common exam trap
Many exam-takers think enabling SNMP on a specific interface or using ACLs is the primary security requirement, but SNMPv3's security is entirely user-based and requires explicit authentication and privacy protocols.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an SNMPv3 user with authentication and privacy protocols.
SNMPv3 requires a user-based security model (USM) with authentication (e.g., SHA) and privacy (e.g., AES) protocols to provide integrity, authentication, and encryption. Without these, SNMPv3 cannot secure monitoring traffic, making option A the mandatory configuration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create an SNMPv3 user with authentication and privacy protocols.
Why this is correct
For SNMPv3 on a FortiGate, the administrator must define an SNMPv3 user under the SNMP configuration and assign both an authentication protocol (e.g., SHA or SHA256) and a privacy protocol (e.g., AES or DES) with passphrases. This creates the USM user credentials that provide message authentication and encryption, which is the defining security feature of SNMPv3. Without this user, the FortiGate cannot accept authenticated and encrypted SNMPv3 queries.
- ✗
Enable SNMP agent on the WAN interface only.
Why it's wrong here
Enabling the SNMP agent solely on the WAN interface is not a required or recommended step for configuring SNMPv3, and it does not replace the need to create a v3 user. The SNMP agent can be enabled on any interface, and the interface selection only controls which networks can reach the agent. More importantly, this action addresses agent availability, not the SNMPv3 security model that requires per-user authentication and privacy protocols.
- ✗
Configure an access control list for SNMP.
Why it's wrong here
An access control list for SNMP, which on FortiGate is typically configured as a list of allowed management hosts or SNMP hosts, controls which source IP addresses are permitted to query the agent. While this can limit exposure, it does not implement SNMPv3's user-based authentication or encryption. The administrator still must create SNMPv3 users with auth/priv protocols; ACLs alone leave the SNMP service vulnerable and do not satisfy the v3 requirement.
- ✗
Set SNMP community string to 'public' and enable SNMPv1/v2c.
Why it's wrong here
Setting the community string to 'public' and enabling SNMPv1/v2c configures legacy, unencrypted SNMP, not SNMPv3. Community strings are transmitted in plaintext and function as a shared password with no per-user identity or privacy protection. SNMPv3 uses a separate user-based security model with authentication and privacy protocols, so this option is both insecure and technically incorrect for the stated goal of configuring SNMPv3.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 773 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.