Auditors find default SNMP community strings still enabled on routers that manage traffic for utility billing. Which hardening step is most urgent?
Select an answer to reveal the explanation.
Short Explanation
Default SNMP strings are the spare key taped under the mat—everybody in the industry knows to look. Rip them out, use authenticated management, and lock who can talk to the routers.
Full Explanation
Default SNMP community strings on routers that carry utility billing traffic are widely known credentials taped under the metaphorical mat. Urgent hardening removes those defaults, disables unneeded SNMP versions or migrates to authenticated SNMPv3, restricts which management sources may poll or set, and applies baseline secure configurations across the device fleet. SNMP often exposes topology, interface counters, and sometimes write capabilities; leaving defaults enabled turns routine network management into an open reconnaissance and reconfiguration channel.
Publishing community strings in the internal wiki so every technician can poll quickly expands insider and leaked-credential risk rather than fixing weak authentication. Enabling SNMP write with the same default string on all WAN routers for consistency industrializes compromise: one string reconfigures the fleet. Ignoring SNMP because it is supposedly read-only by culture fails when communities actually permit writes or when read-only data still maps the billing path for attackers.
Exam caveat: CISSP device hardening expects removal of default credentials and use of authenticated management protocols with source restriction. Documentation of weak secrets is not remediation.
Operational check: scan for default public/private communities; convert monitoring to SNMPv3 with least-privilege views; ACL SNMP to NMS subnets only; disable SNMPv1/v2c where possible; and verify write access is off unless explicitly required and audited.