SNMPv3 is the only version that supports authentication.


ACL related problems would deny traffic.  You would not see an AUTHFAIL if the ACL was a problem.

the community strings are valid.

You cannot configure SNMP authentication on SNMPv2 and below

Only option to support authentication failures is to update to SNMP v3

same question and answers

Diagram has router a twice, no router b.

R3 show that gig 0/1 172.16.250.2 is up up. This is the interface to R2 gig 0/0
R3 shows 172.16.250.14 is connected to gig 0/2.  This address doen't exist on exhibit diagram.


Answer is correct.  question is misleading because configs are nor correct.

Routing table of R4 shows that R4 does not know about 192.168.1.0/30 or 192.168.2.0/24.

Traceroute shows that there is a routing problem between R1 and R2.
R1 knows how to get to R2. This is evident in R3's routing table which shows 172.16.0.0/16 via R1. This also proves that R1 and R2 are eigrp neighbors.

putting a static route on R4 wont fix the problem between R1 and R2.

Redistributing routes into EIGRP does not work without assigning a metric. The option to use a route map to set a metric does not work.  No where is the route map tied to eigrp.

The exhibit showing pings has wrong destinations.  Should be pinging 10.1.1.x not 10.1.2.x

Diagram shows Client on the 10.1.2.0/24 network.  but R2 fa 0/1 is configured for 10.1.1.1/24.  

This question is also a bad example of summarization.  R2 sees 10.1.1.0/24 as directly connected and connects to 10.1.2.0/24 using the summary router 10.0.0.0/8.  R1 performs the same.  

I am not sure what the problem is here but it is not caused by auto-summarization. Full network connectivity exists with the current configuration.

PC1> trace 10.1.2.10
trace to 10.1.2.10, 8 hops max, press Ctrl+C to stop
1  10.1.1.1  0.260 ms  0.107 ms  0.140 ms
2  192.168.1.1  0.365 ms  0.299 ms  0.376 ms
3  *10.1.2.10  0.427 ms (ICMP type:3, code:3, Destination port unreachable)

PC1>


R1#show ip route 10.0.0.0
Routing entry for 10.0.0.0/8, 4 known subnets
  Attached (2 connections)
  Variably subnetted with 3 masks
  Redistributing via eigrp 10
D        10.0.0.0/8 is a summary, 00:06:23, Null0
C        10.1.1.0/24 is directly connected, Ethernet0/1
L        10.1.1.1/32 is directly connected, Ethernet0/1
D        10.1.2.0/24 [90/307200] via 192.168.1.1, 00:05:29, Ethernet0/0
R1#

1. you cant really configgure SSH service on a cisco device. You can configure SSH, you can allow it on the VTY Lines.  You can force it to user v1 or v2 but there is no command to configure it as a service.  If SSH was misconfigured you would not get a prompt for a password.


2. If Transport input SSH/ALL is not configured on the line, you will get connection refused.  Not a prompt for a password.

user@user-pc:~$ ssh admin@198.51.100.64
ssh: connect to host 198.51.100.64 port 22: Connection refused


3. If telnet was requiring local database with username/password for authenticaiton, it would prompt for a user name.

user@user-pc:~$ telnet 198.51.100.64
Trying 198.51.100.64
Connected to 198.51.100.64.
Escape character is '^]'.


User Access Verification

Username: admin
Password:
R1>


4. If the vty lines are not configured for local authentication, telnet will work because of the following config

line vty 0 4
login
password admin

SSH attempts will experience an authentication failure without login local configured on the vty lines.

R1#sh run | inc snmp
mmi snmp-timeout 180
R1#
R1#
R1#
R1#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
R1(config)#snmp-server community ccnp
R1(config)#
R1(config)#do sh snmp community

Community name: ILMI
Community Index: ILMI
Community SecurityName: ILMI
storage-type: read-only  active


Community name: ccnp
Community Index: ccnp
Community SecurityName: ccnp
storage-type: nonvolatile        active



Adding the command, 'snmp-server host 172.16.4.4 ccnp' has no impact on the output of 'show snmp community'.  There is no way to tell from the question if the command is present.



R1(config)#snmp-server host 172.16.4.4 ccnp
R1(config)#
R1(config)#
R1(config)#do sh snmp community

Community name: ILMI
Community Index: ILMI
Community SecurityName: ILMI
storage-type: read-only  active


Community name: ccnp
Community Index: ccnp
Community SecurityName: ccnp
storage-type: nonvolatile        active


The command snmp-server community ccnp 4 is present.  It requries the snmp server to only allow hosts permitted in access-list 4.


R1(config)#snmp-server community ccnp ?
  <1-99>      Std IP accesslist allowing access with this community string
  <1300-1999>  Expanded IP accesslist allowing access with this community
              string
  WORD        Access-list name
  ipv6        Specify IPv6 Named Access-List
  ro          Read-only access with this community string
  rw          Read-write access with this community string
  view        Restrict this community to a named MIB view
  <cr>

R1(config)#snmp-server community ccnp 4
R1(config)#
R1(config)#do sh snmp community

Community name: ILMI
Community Index: ILMI
Community SecurityName: ILMI
storage-type: read-only  active


Community name: ccnp
Community Index: ccnp
Community SecurityName: ccnp
storage-type: nonvolatile        active access-list: 4


R1(config)#

The questions in the practice test were exact.   3 out of the 4 Sims were also on the exam.  There was one Sim that almost tripped me up.   It is not in the practice test.  It references aaa authentication.   

Why is address-family ipv6 multicast the correct answer?

Shouldn't the correct answer be 

router bgp 65000
no bgp default ipv4-unicast
address-family ipv6 unicast
network 2001:db8::/64