CISSP Communication and Network Security Practice Question
A security engineer is configuring SNMPv3 on network devices. The policy requires both authentication and encryption of SNMP messages. Which combination of protocols should be used to meet this requirement?
⚠ Common exam trap
The trap here is that candidates see 'authPriv' and assume any combination of authentication and encryption protocols will work, but the CISSP exam expects you to recognize that MD5 and DES are deprecated and insecure, making option A a distractor despite the correct security level.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
authPriv with SHA and AES
SNMPv3's authPriv security level requires both authentication and encryption. SHA (or SHA-2) provides message authentication via HMAC, and AES provides symmetric encryption for the message payload. This combination satisfies the policy requirement for both confidentiality and integrity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
authPriv with MD5 and DES
Why it's wrong here
While valid, MD5 and DES are weaker; but the question asks for a combination that meets the requirement, and this also meets it. However, AES is stronger. The best answer is authPriv with SHA and AES.
- ✗
noAuthNoPriv with no security
Why it's wrong here
The noAuthNoPriv security level in SNMPv3 offers no authentication and no encryption for SNMP messages. This means that all SNMP packets are sent in plaintext, without any integrity checks or confidentiality, making them highly vulnerable to eavesdropping, tampering, and unauthorized access. It is the weakest security level and should only be used in highly controlled, trusted network segments where security is not a concern, which is rarely appropriate for modern network management.
- ✗
authNoPriv with SHA and no encryption
Why it's wrong here
The authNoPriv security level provides message authentication and integrity using cryptographic hashing algorithms like SHA, ensuring that messages originate from a legitimate source and have not been tampered with in transit. However, it explicitly does not encrypt the SNMP message payload, meaning sensitive network configuration or performance data remains visible to anyone performing packet capture. While integrity is protected, confidentiality is entirely absent, which is often unacceptable for managing critical network infrastructure.
- ✓
authPriv with SHA and AES
Why this is correct
The authPriv security level is the strongest available in SNMPv3, providing both message authentication and data confidentiality. Using SHA (Secure Hash Algorithm) for authentication ensures message integrity and origin authenticity, preventing unauthorized modification or spoofing of management commands or data. Concurrently, AES (Advanced Encryption Standard) encrypts the entire message payload, protecting sensitive network data from eavesdropping and ensuring privacy, making it the recommended configuration for secure network management.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Encryption
Encryption is the process of converting readable data into a secret code to prevent unauthorized access.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.