To improve SNMP security without disabling remote monitoring, which action is recommended?

• A. Disable SNMP entirely
• B. Change the default community strings
• C. Allow SNMP over unencrypted channels
• D. Only read-only access enabled

Answer: (B)

SNMP authentication often relies on community strings, which act like simple passwords. When these strings are left at defaults (for example, a common read string or a common read-write string), anyone who can reach the device can potentially access or alter its monitoring data. Replacing those default strings with strong, unique values makes it much harder for an attacker to guess credentials, so you keep remote monitoring functioning while reducing the risk of unauthorized access.

Other options would either stop monitoring entirely, expose data by enabling unencrypted channels, or provide only partial access without addressing the risk posed by default credentials. For stronger security in this scenario, upgrading to SNMPv3 with authentication and encryption would be ideal, but among the given choices, changing the default community strings offers the most effective improvement.