Examkin

Question

Difficulty: Very hardNetwork Performance Monitoring and Metrics

A senior network operations engineer is implementing a centralized telemetry and performance monitoring solution for core routers transmitting sensitive enterprise data across a shared infrastructure. The monitoring design requires real-time interface throughput polling and immediate alert notifications whenever link utilization breaches critical thresholds. Additionally, security compliance mandates that all monitoring data, including administrative credentials and metric payloads, must provide both message integrity verification and cryptographic privacy during transmission over untrusted network segments. Which of the following protocol configurations correctly satisfies all performance monitoring and security compliance requirements?

  1. Implement SNMPv3 utilizing the User-based Security Model (USM) configured at the authPriv security level with SHA for authentication and AES for payload encryption.Answer
  2. B
    Implement SNMPv3 utilizing the User-based Security Model (USM) configured at the authNoPriv security level with SHA for authentication and DES for privacy.
  3. C
    Implement SNMPv2c utilizing read-only community strings while enforcing SNMP trap alerts to send unencrypted polling statistics over UDP port 162.
  4. D
    Implement NetFlow v9 exported over UDP port 161 combined with standard Syslog logging over TCP port 2055 to stream interface bandwidth metrics.

Answer

Implement SNMPv3 utilizing the User-based Security Model (USM) configured at the authPriv security level with SHA for authentication and AES for payload encryption.
The correct answer provides complete message integrity and privacy by deploying SNMPv3 under the User-based Security Model (USM) at the authPriv level. This combination enforces HMAC SHA for authenticating packets and AES for encrypting performance monitoring data payloads.

Step-by-Step Solution

1
Analyze the functional and security monitoring requirements.
The scenario demands polling interface metrics, receiving alert notifications (traps/informs), verifying message integrity, and enforcing payload privacy (encryption).
Security compliance requires both data origin authentication and payload confidentiality.
2
Evaluate SNMP versions and security levels.
SNMPv1 and SNMPv2c only use cleartext community strings (noAuthNoPriv equivalent). SNMPv3 introduces USM with three security levels: noAuthNoPriv (no authentication, no encryption), authNoPriv (authentication, no encryption), and authPriv (both authentication and encryption).
Only SNMPv3 at the authPriv level fulfills the requirement for combined cryptographic authentication and payload privacy.
3
Verify protocol port assignments and privacy settings across options.
SNMPv3 authPriv with SHA and AES satisfies all security and operational criteria, whereas options specifying authNoPriv, cleartext SNMPv2c, or mismatched standard service ports fail required parameters.
authPriv ensures data cannot be intercepted or modified while traveling across untrusted network segments.

Key Concept

SNMPv3 Security Levels and Telemetry Encryption
Rate this question

Topics

Network Performance Monitoring and Metrics

More questions from this topic