Questions: SNMP: Simple Network Management Protocol

Question 1

A network administrator needs to be alerted immediately when a router's WAN interface goes down. Which SNMP mechanism should they configure to achieve this?

• A. Schedule frequent SNMP GET polling at one-second intervals
• B. Configure the router agent to send SNMP traps or informs to the manager
• C. Use SNMP SET to subscribe to interface state changes on the router
• D. Configure SNMP GETNEXT to walk the interface table continuously

Answer: (B)

SNMP's normal operation is poll-based (pull): the manager periodically sends GET requests to agents. This means alerts are only as fast as the polling interval, which is typically minutes apart. For near-real-time alerting, SNMP traps (or SNMPv2/v3 informs) are the right tool — these are unsolicited messages sent by the agent to the manager when a significant event occurs, like an interface state change. Traps and informs are the exception to SNMP's pull model, enabling event-driven notification without waiting for the next poll cycle.

Question 2

Why is using SNMPv2c community strings considered a serious security risk in production networks?

• A. SNMPv2c community strings expire after 24 hours, causing frequent authentication failures
• B. Community strings are transmitted as plaintext and function as shared passwords, making them visible to anyone who can capture network traffic
• C. SNMPv2c does not support GET operations, limiting monitoring capability
• D. Community strings are stored in plaintext on the manager only; agents encrypt their copy

Answer: (B)

Community strings in SNMPv1 and SNMPv2c are sent in plaintext with every request — any attacker who can sniff network traffic (or is on the same network segment) can read the community string and then use it to query or even modify device configurations. The default 'public' (read) and 'private' (read-write) community strings are widely known. An attacker with the read-write community string can send SNMP SET operations to reconfigure routers and switches. SNMPv3 was introduced specifically to address this, adding HMAC-based authentication and AES/DES encryption.

Question 3

SNMP uses TCP as its transport protocol because management data should be delivered reliably to the network manager.

• T. True
• F. False

Answer: False

SNMP runs over UDP, not TCP. Management traffic is designed to be low-overhead, and the assumption is that occasional lost messages are acceptable — the manager can simply retry a failed GET request. Using TCP would add connection overhead, handshake latency, and flow control mechanisms to every management query, which is unnecessary for periodic polling. UDP's connectionless, fire-and-forget nature suits SNMP's use case, where polling traffic is low-stakes and retries are built into the management software.

Question 4

SNMP GET operations retrieve data from agents on managed devices; agents do not push data to the manager unless explicitly configured to do so via traps.

• T. True
• F. False

Answer: True

This is the fundamental pull model of SNMP. The manager initiates all data collection by sending GET, GETNEXT, or GETBULK requests to agents, which respond with the requested values. Agents only send data proactively via traps (SNMPv1) or informs (SNMPv2c/v3), which must be explicitly configured. This design keeps agents simple and passive by default, but it means monitoring systems must poll frequently enough to detect problems — events that happen between polls may not be noticed until the next GET cycle.

Question 5

What is a MIB, and why does navigating one in practice require specialized tools like a MIB browser rather than just reading the raw file?

Model answer: A MIB (Management Information Base) is a hierarchical tree of variables that defines every piece of data an SNMP agent can expose, with each variable identified by a unique OID (Object Identifier) — a dotted-number path through the tree. In practice, MIBs are large, vendor-specific, and written in a formal language (SMI) that is not human-readable at a glance. A single enterprise device may have hundreds or thousands of OIDs. A MIB browser lets you search by name, navigate the tree visually, and translate OID numbers to human-readable names — without it, finding the specific OID for, say, 'CPU utilization on interface 3' in a vendor's proprietary MIB file is extremely tedious.

The OID naming convention (e.g., 1.3.6.1.2.1.1.3.0 for system uptime) is machine-friendly but not human-friendly. Standard MIBs (RFC 1213 MIB-II) are widely documented, but vendor extension MIBs for proprietary hardware features are often only available as downloadable files from the vendor. A MIB browser indexes these files and provides text search, making the difference between hours and seconds when trying to find the right OID for a specific monitoring metric.