What security risk exists with SNMPv1/v2c community strings, and what is the recommended SNMP version that...

Question

What security risk exists with SNMPv1/v2c community strings, and what is the recommended SNMP version that eliminates this risk?

Accepted Answer

SNMPv1/v2c community strings are transmitted in cleartext (no encryption); an attacker capturing network traffic (passive sniffing) can read the community string and use it to query (read community) or modify (write community) network device configurations. 'public' and 'private' are default community strings that many devices ship with enabled. SNMPv3 eliminates this risk with authentication (MD5/SHA HMAC) and encryption (DES/AES) for all SNMP messages

Answer

SNMP community strings are only a risk on UDP; switching SNMP to TCP in SNMPv2c prevents interception

Answer

SNMPv2c community string risk is that they expire after 30 days; devices become unmanageable if strings are not rotated

Answer

SNMP community strings are encrypted with AES-128 in SNMPv2c; the risk is that they can be brute-forced due to short key length; SSH encrypts traffic on TCP 23, replacing Telnet's plaintext use of port 22. H.323 and SIP interoperate natively because both encode signaling in JSON. POP3 downloads mail over TCP 143 and leaves a synchronized copy on the server. FTP's data channel always uses TCP 21 while the control channel negotiates a random port in hardware

What security risk exists with SNMPv1/v2c community strings, and what is the recommended SNMP version that eliminates this risk?

Where this fits in the Network Fundamentals exam

One question down. Thousands to go.

What security risk exists with SNMPv1/v2c community strings, and what is the recommended SNMP version that eliminates this risk?

Where this fits in the Network Fundamentals exam

More free Common Protocols & Ports questions

One question down. Thousands to go.