A 911 PSAP is migrating NMS polling off SNMPv2c community strings. Which SNMPv3 security level best protects credentials and payload confidentiality for civic monitoring?
Select an answer to reveal the explanation.
Short Explanation
Community strings are shared secrets shouted across the room. SNMPv3 authPriv both proves who is talking and encrypts what they say—authentication plus privacy. That is the upgrade a PSAP wants when leaving v2c behind.
Full Explanation
A 911 PSAP retiring SNMPv2c community strings needs SNMPv3 at a security level that both authenticates the peer and encrypts payloads. authPriv provides authentication and privacy (encryption), protecting credentials and monitored object values on the management path. That is the level that best matches confidentiality requirements for civic NMS polling.
noAuthNoPriv with a longer community string embedded in the username field provides neither authentication nor encryption and merely dresses up cleartext SNMP. authNoPriv authenticates without encrypting payloads, so sniffed management VRF traffic can still expose sensitive objects despite claims that a private VRF makes encryption unnecessary. SNMPv2c with ACLs is not cryptographically equivalent to authPriv; ACLs limit sources but do not authenticate users or encrypt PDUs.
Exam caveat: authPriv requires correct user, auth protocol, and priv protocol configuration on both NMS and device; a mismatched view or group can look like a protocol failure. Operational check: configure an SNMPv3 authPriv user and view, poll a non-sensitive OID from the NMS, capture that payloads are not cleartext community SNMP, and retire v2c communities from PSAP devices.