How to Enable SNMPv3 Trap Authentication on Cisco IOS?
Short answer
B Configure a v3 SNMP group and user with auth, then set snmp-server host <receiver> version 3 auth <user> to send authenticated traps.
Question
Refer to the exhibit. A network engineer wants to reduce the operational costs of SNMPv3 by using trapping instead of polling. Which code snippet completes the configuration to enable authentication for SNMPv3 trapping?
Key Takeaways
You must match the SNMPv3 group security level, the user’s auth protocol/password, and the host’s version 3 auth keyword; a mismatch means traps are sent at a lower security level or rejected.
This question tests the Cisco IOS SNMPv3 command sequence required to send authenticated traps instead of relying on polling. The correct snippet defines a v3 group and user with authentication, then points the trap host at that same user with version 3 auth.
Common mistake: Choosing a snippet that creates a v3 user but omits the auth keyword on the snmp-server host line, which results in unauthenticated traps rather than SNMPv3 authenticated trapping.
Expert Analysis
Why the Answer Is Correct
Option B uses the complete Cisco IOS SNMPv3 trap chain: snmp-server group MyGroup v3 auth, snmp-server user MyUser MyGroup v3 auth sha..., and snmp-server host... version 3 auth MyUser. The group’s auth keyword sets the minimum security level, the user line supplies the hash protocol and secret, and the host line selects authenticated v3 notifications. If any of those pieces is missing or mismatched, traps are sent at a lower level or discarded. This is why B is the correct snippet for reducing polling while preserving authentication.
Why the Other Options Are Wrong
The distractors are built from partial or mismatched SNMPv3 commands. Some omit the auth keyword on the group or host line, which downgrades the trap to noAuthNoPriv; others reference a different user or group than the one created, so the receiver cannot authenticate the trap. A snippet that sets only a v3 user without tying it to the trap host also fails to enable authenticated trapping. Because the question specifically asks for authentication, any option lacking the v3 auth parameters is incorrect.
Community Comment Notes
klu16 summarizes the working sequence as snmp-server group MyGroup v3 auth, a v3 auth user, and snmp-server host... version 3 auth MyUser, which aligns with B. dfb0b7d cites the snmp-server user syntax with auth md5 or sha, reinforcing that the user line must include a protocol and password. XBfoundX points readers to Cisco documentation for SNMPv3 configuration, while wondaah’s question "whats the difference between b and c?" highlights that the distractors differ mainly in usernames or auth details. The consensus is that B is the only snippet with the complete authenticated trap path.
Exam Strategy
On SNMPv3 questions, verify three things in order: group security level, user auth protocol/password, and host notification auth keyword. The correct option must show all three components; eliminate any snippet that silently falls back to noAuthNoPriv.
Frequently Asked Questions
Why does snmp-server host need the auth keyword for SNMPv3 traps?
Why is a v3 user without an auth password wrong?
Discussion 4 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 4
-
klu16 👍 4 Answered BIt's B. The syntax is: snmp-server group MyGroup v3 auth snmp-server user MyUser MyGroup v3 auth sha MyAuthPass snmp-server host <TrapReceiverIP> version 3 auth MyUser
-
dfb0b7d 👍 2 Answered Bsnmp-server user user-name group-name [remote ip-address [udp-port port]] {v1 | v2c | v3 [encrypted] [auth {md5 | sha} auth-password]} [access access-list] Example: Device(config)# snmp-server user user1 group1 v3 auth md5 password123
-
XBfoundX 👍 1 Answered BLook at the doc here. Is an amazing explaination of snmpv3 config: https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118105-qanda-esa-00.html
-
wondaah 👍 1 Answered Bam i stupid or is there just a different username in the answers? whats the difference between b and c?
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.