How to Enable SNMPv3 Trap Authentication on Cisco IOS?
Refer to the exhibit. A network engineer wants to reduce the operational costs of SNMPv3 by using trapping instead of polling. Which code snippet completes the configuration to enable authentication for SNMPv3 trapping?
Community Insight
You must match the SNMPv3 group security level, the user’s auth protocol/password, and the host’s version 3 auth keyword; a mismatch means traps are sent at a lower security level or rejected.
This question tests the Cisco IOS SNMPv3 command sequence required to send authenticated traps instead of relying on polling. The correct snippet defines a v3 group and user with authentication, then points the trap host at that same user with version 3 auth.
Choosing a snippet that creates a v3 user but omits the auth keyword on the snmp-server host line, which results in unauthenticated traps rather than SNMPv3 authenticated trapping.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option B uses the complete Cisco IOS SNMPv3 trap chain:snmp-server group MyGroup v3 auth, snmp-server user MyUser MyGroup v3 auth sha..., and snmp-server host... version 3 auth MyUser. The group’s auth keyword sets the minimum security level, the user line supplies the hash protocol and secret, and the host line selects authenticated v3 notifications. If any of those pieces is missing or mismatched, traps are sent at a lower level or discarded. This is why B is the correct snippet for reducing polling while preserving authentication.Why the Other Options Are Wrong
The distractors are built from partial or mismatched SNMPv3 commands. Some omit theauth keyword on the group or host line, which downgrades the trap to noAuthNoPriv; others reference a different user or group than the one created, so the receiver cannot authenticate the trap. A snippet that sets only a v3 user without tying it to the trap host also fails to enable authenticated trapping. Because the question specifically asks for authentication, any option lacking the v3 auth parameters is incorrect.Community Comment Notes
klu16 summarizes the working sequence assnmp-server group MyGroup v3 auth, a v3 auth user, and snmp-server host... version 3 auth MyUser, which aligns with B. dfb0b7d cites the snmp-server user syntax with auth md5 or sha, reinforcing that the user line must include a protocol and password. XBfoundX points readers to Cisco documentation for SNMPv3 configuration, while wondaah’s question "whats the difference between b and c?" highlights that the distractors differ mainly in usernames or auth details. The consensus is that B is the only snippet with the complete authenticated trap path. Exam Strategy
On SNMPv3 questions, verify three things in order: group security level, user auth protocol/password, and host notification auth keyword. The correct option must show all three components; eliminate any snippet that silently falls back to noAuthNoPriv.
Frequently Asked Questions
Why does snmp-server host need the auth keyword for SNMPv3 traps?
It selects authenticated v3 traps and must match the user’s auth settings; without it, traps are sent at noAuthNoPriv or rejected.
Why is a v3 user without an auth password wrong?
SNMPv3 auth requires both a protocol such as md5 or sha and a password; omitting them leaves the user at noAuthNoPriv, so authenticated trapping fails.