Examkin

Soru

Zorluk: ZorNetwork Logging and Auditing

A network administrator is implementing a centralized monitoring solution for enterprise core switches. Organizational compliance policies dictate that network management queries and event trap messages transmitted across the network must guarantee cryptographic integrity, user authentication, and payload confidentiality to prevent eavesdropping and replay attacks. Which protocol implementation best satisfies all specified auditing and monitoring security requirements?

  1. SNMPv3 configured with the authPriv security model using SHA for authentication and AES for encryptionCevap
  2. B
    SNMPv2c configured with a read-only community string and TLS encapsulation over TCP port 162
  3. C
    SNMPv3 configured with the authNoPriv security model using MD5 for authentication and DES for privacy
  4. D
    Syslog configured to forward trap notifications over UDP port 161 using community string authentication

Cevap

SNMPv3 configured with the authPriv security model using SHA for authentication and AES for encryption
The option specifying SNMPv3 configured with the authPriv security model using SHA for authentication and AES for encryption is correct because authPriv (Authentication and Privacy) is the only SNMP security level that enforces both cryptographic user authentication and payload encryption, meeting the security baseline requirements.

Adım Adım Çözüm

1
Analyze security baseline requirements
Identified the need for message integrity, user authentication, and data privacy (payload confidentiality).
Compliance demands protection against both active tampering and passive packet capture/eavesdropping.
2
Evaluate protocol security models for SNMP versions
SNMPv1 and SNMPv2c use unencrypted community strings (no privacy/authentication). SNMPv3 introduces security models: noAuthNoPriv, authNoPriv, and authPriv.
Only SNMPv3 authPriv provides both message authentication (SHA/MD5) and payload encryption (AES/DES).
3
Verify port and operational parameters
SNMP queries use UDP 161 and SNMP traps use UDP 162. SNMPv3 authPriv directly fulfills management and alerting security controls.
Selecting SNMPv3 authPriv satisfies all audit, logging, and security baseline controls.

Anahtar Kavram

SNMPv3 Security Levels (authPriv vs. authNoPriv vs. noAuthNoPriv)
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Network Logging and Auditing

Bu konudan daha fazla soru