ccna 200-301 question bank

ccna 200-301 question bank.The get and set operations can also introduce vulnerabilities that can expose SNMP to attacks.48 Chapter 2 Protecting Network Devices2.3.4.5 SNMP Group StringsThe SNMP agent accepts commands and requests from SNMP management systems only if those systems have the correct communitystring. The SNMP community string is a text string that authenticates information between the management site and the SNMP agent and allows access to MIB information. Group strings are basically used for password-only message authentication between the NMS and the agent.There are two types of group strings: read-only group characters-providing read-only access to all M1B objects except group strings.Read-write group strings-provide read-write access to all MIB objects except the group string.If the manager sends the correct read-only group string, it can access the information in the agent but cannot set it; if the manager sends the correct read-write group string, it can access and set the information in the agent. In effect, havingset access to the router is equivalent to having the enable password for the router.By default, most SNMP systems use "public" as the group string. If you configure the router SNMP agent to use this common known group string, anyone using the SNMP system can read the router's MIBo Since the router MIB can point to the routing table and other key parts of the router's configuration, it is important to create your own SNMP group string.However, even if the group string is modified, the string is still transmitted in plaintext, which is a huge flaw in the SNMPvl and SNMPv2 architectures. If in-band management is used, to reduce security risks, SNMP management should be configured to extract (pull) information from the device only and not allow "set" changes to be pushed to the device. To ensure that management information is extracted, each device should be configured with a read-only SNMP group string.