Examkin

Question

Difficulty: HardNetwork Logging and Auditing

A network administrator is implementing a centralized monitoring solution for enterprise core switches. Organizational compliance policies dictate that network management queries and event trap messages transmitted across the network must guarantee cryptographic integrity, user authentication, and payload confidentiality to prevent eavesdropping and replay attacks. Which protocol implementation best satisfies all specified auditing and monitoring security requirements?

  1. SNMPv3 configured with the authPriv security model using SHA for authentication and AES for encryptionAnswer
  2. B
    SNMPv2c configured with a read-only community string and TLS encapsulation over TCP port 162
  3. C
    SNMPv3 configured with the authNoPriv security model using MD5 for authentication and DES for privacy
  4. D
    Syslog configured to forward trap notifications over UDP port 161 using community string authentication

Answer

SNMPv3 configured with the authPriv security model using SHA for authentication and AES for encryption
The option specifying SNMPv3 configured with the authPriv security model using SHA for authentication and AES for encryption is correct because authPriv (Authentication and Privacy) is the only SNMP security level that enforces both cryptographic user authentication and payload encryption, meeting the security baseline requirements.

Step-by-Step Solution

1
Analyze security baseline requirements
Identified the need for message integrity, user authentication, and data privacy (payload confidentiality).
Compliance demands protection against both active tampering and passive packet capture/eavesdropping.
2
Evaluate protocol security models for SNMP versions
SNMPv1 and SNMPv2c use unencrypted community strings (no privacy/authentication). SNMPv3 introduces security models: noAuthNoPriv, authNoPriv, and authPriv.
Only SNMPv3 authPriv provides both message authentication (SHA/MD5) and payload encryption (AES/DES).
3
Verify port and operational parameters
SNMP queries use UDP 161 and SNMP traps use UDP 162. SNMPv3 authPriv directly fulfills management and alerting security controls.
Selecting SNMPv3 authPriv satisfies all audit, logging, and security baseline controls.

Key Concept

SNMPv3 Security Levels (authPriv vs. authNoPriv vs. noAuthNoPriv)
Estimated Time:1m 30s
Rate this question

Topics

Network Logging and Auditing

More questions from this topic