CISSP Communication and Network Security Practice Question
A network administrator is configuring SNMPv3 for monitoring network devices. The organization requires both authentication and encryption of SNMP traffic. Which combination of protocols should be used to meet this requirement?
⚠ Common exam trap
A common mix-up: candidates think DES is acceptable because it provides encryption, but CISSP emphasizes that DES is cryptographically weak and not considered secure for modern use, making AES the correct privacy choice.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SHA for authentication, AES for privacy
SNMPv3 supports both authentication and encryption via separate User-based Security Model (USM) parameters. To meet the requirement for both, you must select an authentication protocol (e.g., SHA) and a privacy (encryption) protocol (e.g., AES). Option C correctly pairs SHA for authentication with AES for privacy, providing integrity verification and confidentiality of SNMP messages.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
MD5 for authentication, no privacy
Why it's wrong here
This option is incorrect because MD5 is a cryptographically weaker hashing algorithm, making it more susceptible to collision attacks and compromising message integrity. Furthermore, the complete absence of a privacy mechanism means that all monitored data is transmitted in plaintext, leaving it vulnerable to eavesdropping and disclosure by any party with network access, which is unacceptable for secure network management.
- ✗
SHA for authentication, no privacy
Why it's wrong here
This option is incorrect because, despite using SHA for stronger authentication compared to MD5, the critical lack of a privacy component means that all SNMP messages, including potentially sensitive network statistics and configuration details, are transmitted unencrypted. This exposes the data to passive wiretapping and unauthorized disclosure, failing to meet fundamental confidentiality requirements for secure network monitoring.
- ✓
SHA for authentication, AES for privacy
Why this is correct
This option is correct because it combines the strongest available security algorithms within SNMPv3's User-based Security Model (USM). SHA (Secure Hash Algorithm) provides robust message integrity and authentication, ensuring that messages have not been tampered with and originate from a legitimate source. AES (Advanced Encryption Standard) delivers strong confidentiality, encrypting the entire SNMP message to protect sensitive monitoring data from eavesdropping and unauthorized disclosure, aligning with current best practices for secure network management.
- ✗
MD5 for authentication, DES for privacy
Why it's wrong here
This option is incorrect because both MD5 and DES are considered cryptographically weak algorithms in modern security contexts. MD5 is vulnerable to collision attacks, which can compromise message integrity and authentication, while DES, with its 56-bit key, is easily broken by modern computing power. Relying on these outdated algorithms provides inadequate protection for sensitive network management traffic against determined adversaries, despite offering both authentication and privacy.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.