CISSP Communication and Network Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  AuthNoPriv

  Why it's wrong here

  The AuthNoPriv security level in SNMPv3 provides message integrity and origin authentication using cryptographic hashing algorithms, such as MD5 or SHA, to protect against unauthorized modification and spoofing. However, it explicitly does not encrypt the payload of SNMP messages. This means that while the authenticity of the message sender and the integrity of the data are verified, the actual content of the network management information is transmitted in plaintext, making it vulnerable to eavesdropping and disclosure by unauthorized parties.

• ✗

  AuthPriv with MD5 and DES

  Why it's wrong here

  While the AuthPriv security level inherently offers both authentication and privacy (encryption), selecting MD5 for authentication and DES for encryption represents a significantly weaker and outdated cryptographic choice. MD5 is known to be vulnerable to collision attacks, compromising message integrity and authentication, while DES, with its 56-bit key, is susceptible to brute-force attacks. Although it technically provides some level of security, these algorithms do not meet current industry standards for robust protection and fail to align with the implied requirement for a truly secure SNMPv3 configuration.

• ✓

  AuthPriv with SHA and AES

  Why this is correct

  The AuthPriv security level, combined with SHA for authentication and AES for privacy, represents the strongest and most recommended configuration for SNMPv3. SHA (Secure Hash Algorithm, typically SHA-256 or higher) provides robust message integrity and origin authentication, effectively preventing tampering and spoofing. Concurrently, AES (Advanced Encryption Standard) offers strong symmetric encryption, ensuring the confidentiality of sensitive network management data. This combination aligns with best practices for securing network communications, mitigating risks from eavesdropping, data modification, and unauthorized access.

• ✗

  NoAuthNoPriv

  Why it's wrong here

  The NoAuthNoPriv security level in SNMPv3 provides no cryptographic security mechanisms whatsoever, offering neither authentication nor privacy. SNMP messages transmitted under this configuration lack any integrity checks, origin authentication, or encryption. This renders them highly vulnerable to various attacks, including tampering, spoofing, and eavesdropping, as the data is sent completely unprotected. Consequently, this security level is functionally equivalent to the insecure SNMPv1 or SNMPv2c community string model and is entirely unsuitable for any environment requiring secure network management.

Go deeper

Related to this question