Configuring SNMPv3 for Active Monitoring on Cisco ASA via ASDM
An administrator needs to configure the Cisco ASA via ASDM such that the network management system can actively monitor the host using SNMPv3. Which two tasks must be performed for this configuration? (Choose two.)
Community Insight
The exam tests the distinction between configuring the security model (USM/User Group) for read-only access versus configuring trap destinations; the common trap is selecting 'Add SNMP host access' which is for traps, not active polling.
This question addresses the configuration of SNMPv3 on a Cisco ASA to allow active monitoring by a Network Management System (NMS). It establishes that creating an SNMP user group and adding a USM entry are the critical steps for defining access credentials in SNMPv3, distinct from trap recipients or community strings.
Candidates often choose 'Add an SNMP host access entry' (Option C), confusing active monitoring (polling) with trap reception. Another common error is selecting 'Specify a community string' (Option E), which applies only to SNMPv1/v2c, not SNMPv3.
Community Discussion (14 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
To enable a Network Management System (NMS) to actively monitor a Cisco ASA using SNMPv3, the administrator must define who can access the device and how they authenticate. This requires two main tasks: specifying an SNMP user group (which defines the access level, e.g., ro/rw) and adding an SNMP USM (User-based Security Model) entry (which creates the specific username and authentication/privacy keys associated with that group). Options A and B are the foundational components for SNMPv3 user-based access control.Why the Other Options Are Wrong
Option C ('Add an SNMP host access entry') is incorrect because this configures the ASA to send traps to a specific host, rather than allowing a host to poll the ASA. Option D is partially redundant as the host entry handles the port, but it's not the primary credential setup. Option E ('Specify a community string') is incorrect because SNMPv3 uses usernames and cryptographic keys (USM), not community strings, which are legacy SNMPv1/v2c mechanisms.Community Comment Notes
Multiple commenters, including Initial14 and Jessie45785, correctly identified options A and B as the right answer. One commenter noted that "C answer adds host for snmp traps," highlighting the key distinction between polling and trapping. Another verified that "SNMPv3 does not have community string," ruling out option E immediately. The consensus among high-vote comments aligns with the official Cisco documentation reference provided.Official Reference
Exam Strategy
When asked about 'active monitoring' or 'polling', think about the client-side credentials required to log into the device (User/Group). When asked about 'notifications' or 'traps', think about the server-side destination (Host Access Entry). Always check the SNMP version; if it's v3, discard any option mentioning 'community string'.
Frequently Asked Questions
Why is Option C wrong for active monitoring?
Option C configures where the ASA sends traps. Active monitoring requires the NMS to poll the ASA, which needs user credentials (Options A and B), not a trap destination.
Can I use a community string for SNMPv3?
No. Community strings are used in SNMPv1 and v2c. SNMPv3 uses the User-based Security Model (USM) with usernames and cryptographic keys for authentication and privacy.