Examkin

Question

Difficulty: MediumNetwork Device Hardening Best Practices

A network administrator is securing a newly deployed edge router at a remote facility. The organization requires central monitoring of system health over public networks while enforcing payload encryption and cryptographic user authentication. Additionally, legacy unencrypted protocols must be removed. Which configuration strategy best satisfies these hardening requirements for network monitoring?

  1. Configure SNMPv3 with authPriv mode using strong passphrase hashing and AES payload encryption.Answer
  2. B
    Configure SNMPv2c using a complex, non-default read-only community string over port 161.
  3. C
    Enable Telnet access restricted exclusively to the centralized monitoring server IP address via an inbound ACL.
  4. D
    Reassign all switch ports to the untagged native VLAN to isolate administrative SNMP traffic from user data.

Answer

Configure SNMPv3 with authPriv mode using strong passphrase hashing and AES payload encryption.
Configuring SNMPv3 with the authPriv security level ensures both user authentication (using SHA or MD5) and payload encryption (using AES or DES). This guarantees that network monitoring statistics and system management traffic cannot be eavesdropped on or modified in transit across untrusted network links.

Step-by-Step Solution

1
Identify security requirements for management monitoring
Requirements specify central health monitoring over untrusted networks with authentication and payload encryption.
Cleartext protocols expose administrative credentials and telemetry to eavesdropping.
2
Evaluate protocol features for SNMP versions
SNMPv1 and SNMPv2c use cleartext community strings (no encryption). SNMPv3 supports noAuthNoPriv, authNoPriv, and authPriv.
Only SNMPv3 authPriv provides both message integrity/authentication and data privacy (encryption).
3
Select the hardening control matching all criteria
SNMPv3 in authPriv mode meets both cryptographic authentication and AES payload encryption mandates.
This establishes robust management plane hardening for monitoring over public or shared network infrastructure.

Key Concept

SNMP Security Modes and Management Plane Hardening
Estimated Time:1m 0s
Rate this question

Topics

Network Device Hardening Best Practices

More questions from this topic