Exam 350-701 topic 1 question 122 discussion

I think the correct answer is C - https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/snmp/configuration/xe-3e/snmp-xe-3e-book/nm-snmp-snmpv3-comm-supp.html

It looks like none of the options given make sense: A and B are part of the user creation command, C does not make any sense since views can be assigned to groups, not users and D is wrong because it only makes sense if a SNMP host is being configured.

Don't Overthink the question A network administrator is configuring SNMPv3 on a new router. The users have already been created, however an additional configuration is needed to facilitate access to the SNMP views. What must the administrator do to accomplish this? The question is stating the users have been created, but never said any other commands had been used. Thus they ask "an additional config is needed to access SNMP views". At the moment we only have Users, but no views. Thus only logical answer would be map SNMPv3 users to SNMPv3 views. As that had not been done yet as we only had users.

I'll go with B because I believe the user is using the noAuth command. The following example shows how to configure a remote user to receive traps at the “noAuthNoPriv” security level when the SNMPv3 security model is enabled: Device(config)# snmp-server group group1 v3 noauth Device(config)# snmp-server user remoteuser1 group1 remote 10.12.8.4 Device(config)# snmp-server host 10.12.8.4 informs version 3 noauth remoteuser config

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/snmp/configuration/xe-3e/snmp-xe-3e-book/nm-snmp-snmpv3-comm-supp.html

Yes Tjhe correct Answer is C https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/snmp/configuration/15-e/snmp-15-e-book.pdf

"however an additional configuration is needed to facilitate access to the SNMP views" Need to give the user or groups access to the view

"B" For requests to be authenticated, the manager and the agent must share knowledge of the authentication password associated with the username. For requests to be encrypted, the manager and the agent must additionally share knowledge of the privacy password associated with the username.

"B" The secure management of SNMPv3 is an important enabling technology for safe configuration and control operations. SNMPv3 provides security with authentication and privacy, and its administration offers logical contexts, view-based access control, and remote configuration.

I agree with C. You can assign users or groups to views

It is A • 2.8 Configure secure network management of perimeter security and infrastructure devices (secure device management, SNMPv3, views, groups, users, authentication, and encryption, secure logging, and NTP with authentication)

Agree with C, here's what Cisco document says about it: To configure a Simple Network Management Protocol Version 3 (SNMPv3) server user, specify an SNMP group or a table that maps SNMPv3 users to SNMP views.

It is C, on Cisco site: "To configure a Simple Network Management Protocol Version 3 (SNMPv3) server user, specify an SNMP group or a table that maps SNMPv3 users to SNMP views."

The question is what is SNMP v3 according to Cisco (table 3): The SNMP Version 3 feature is used to provide secure access to devices by authenticating and encrypting data packets over the network. https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/snmp/configuration/xe-3se/5700/snmp-xe-3se-5700-book/nm-snmp-snmpv3.pdf Then we need to provide SNMP Priv mode with both authentication and encryption, that is answer A+B. or only A if we consider the authentication is already provided.

I think you have to configure a view to be able to configure a group. You need a group to be able to configure a user. The PW and encryption is set while creating the user. So if the user is already created, a group and a view is also created. This leaves me with D which makes me not happy.

This question is too vague to properly answer. When you create the user, you assign them to the group and this provides access to the view. C would be plausible if you mapped users to views but you don' t map users to views, you assign users to groups which provides access to views. The group and user option would enough in a NoAuth model. the answer wording is questionable C but it could be the answer based on NoAuth. Since we don't know the model that is being used. It's hard to say. With AuthNoPriv you would need the auth password. With AuthPriv you would need both the auth password and encryption. However in no case would just the encryption be enough by itself to allow access. For A to be correct, we'd have to assume that the user has been assigned to the group and that the auth password is correct.