What security best practices should be applied when deploying NPM in production?

• A. Default credentials can be used for convenience
• B. Least-privilege RBAC, SNMPv3, encrypted credentials, secure communication, regular updates, and network segmentation
• C. Use only SNMPv1
• D. Disable all security features

Answer: (B)

Security in production centers on restricting who can do what, protecting credentials, and keeping data in transit and at rest secure. The best approach is to apply least-privilege access via role-based access control so every user and system has only the permissions they truly need. This minimizes damage if an account is compromised. Use SNMP version 3 for device monitoring because it provides authentication and optional encryption, which protects against eavesdropping and tampering; older SNMP versions rely on plaintext community strings and lack strong security.

Store credentials in encrypted form and use a secrets manager or secure storage instead of placing plaintext passwords in configuration files. Ensure everywhere you communicate, the channel is secured—the web interface and API traffic should run over TLS/HTTPS, and any device or agent communications should be encrypted or placed behind secure tunnels when possible. Keep the NPM platform and its dependencies up to date with regular patches to fix known vulnerabilities and reduce exposure.

Finally, network segmentation limits what an attacker can access if a component is compromised. Position NPM in its own segment with strict firewall rules, allowing only the necessary traffic to and from trusted devices and services.

The other options undermine security: default credentials are a well-known risk; using only older SNMP versions provides no protection; and disabling security features removes defenses entirely.