19+ practice questions focused on Syslog — one of the most tested topics on the CCNA 200-301 v2 exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Syslog PracticeAfter a hub was connected to interface Gi0/10, the interface immediately entered errdisable state. The following syslog message was generated: '%PORT_SECURITY-2-PSECURE_VIOLATION: Security violation occurred on interface Gi0/10.' What is the strongest explanation for why Gi0/10 shut down?
Explanation: The strongest explanation is a port-security violation caused by the switch seeing more secure MAC addresses than the interface allows. In practical terms, a hub or unmanaged device can cause multiple end hosts to appear behind one access port. If the interface is configured with a maximum of one secure MAC address, additional learned MACs trigger the violation action. This is a realistic access-layer security scenario because the port does not fail randomly. It fails because the observed behavior violates the configured policy.
Exhibit: An engineer wants a device to send only warning messages and more critical events to a syslog server. Which logging level should be configured?
Explanation: Syslog severity levels include lower numbers for more severe events. Warning is level 4, so setting logging trap warnings sends level 4, 3, 2, 1, and 0 messages.
You are connected to R1. Configure NTP client so that R1 synchronizes with the NTP server at 198.51.100.10, using its Loopback0 (10.0.0.1/32) as the source interface. Also configure syslog to send messages of severity 5 (notifications) and above to 192.0.2.20. The current configuration shows a misconfigured NTP server address and an incorrect logging trap level. Verify with 'show ntp status' (stratum should not be 16) and 'show logging'.
Explanation: The misconfigured NTP server address (203.0.113.5) and the debug-level logging trap (7) must be corrected to meet requirements. The correct commands are 'ntp server 198.51.100.10 source Loopback0' to use the specified server and Loopback0 as source, and 'logging trap notifications' (severity 5) to send only notifications and more severe messages. Option B is wrong because 'logging trap 4' sets the trap level to warning, which would not forward notifications. Option C misses the source interface, and Option D uses the wrong NTP server and an overly verbose trap level.
A network operations team wants centralized logging from routers and switches and also wants meaningful severity filtering. Which two statements about syslog are correct?
Explanation: Syslog provides centralized event reporting by allowing devices to send log messages to a remote server (option A is correct). Severity levels enable filtering based on event seriousness (option B is correct). Option C is incorrect because syslog does not assign IP addresses dynamically—that is the role of DHCP. Option D is incorrect because syslog logs events and does not replace SNMP counters, which remain the primary method for collecting interface statistics.
Drag and drop the syslog severity levels on the left to their corresponding names and meanings on the right.
Explanation: All four options correctly match syslog severity levels 0-3 with their descriptions. Levels 0 (Emergency), 1 (Alert), 2 (Critical), and 3 (Error) are the highest severity levels.
+14 more Syslog questions available
Practice all Syslog questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Syslog. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Syslog questions on the 200-301 frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Syslog is tested as part of the CCNA 200-301 v2 blueprint. Practicing with targeted Syslog questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free 200-301 practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Syslog is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Syslog practice session with instant scoring and detailed explanations.
Start Syslog Practice →