Courseiva
Knowledge + Practice
CertificationsVendorsCareer RoadmapsLabs & ToolsStudy GuidesGlossaryPractice Questions
C
Courseiva

Free IT certification practice questions with explained answers for CCNA, CompTIA, AWS, Azure, Google Cloud, and more.

Certification Practice Questions

CCNA practice questionsSecurity+ SY0-701 practice questionsAWS SAA-C03 practice questionsAZ-104 practice questionsAZ-900 practice questionsCLF-C02 practice questionsA+ Core 1 practice questionsGoogle Cloud ACE practice questionsCySA+ CS0-003 practice questionsNetwork+ N10-009 practice questions
View all certifications →

Product

CertificationsCertification PathsExam TopicsPractice TestsExam Dumps vs Practice TestsStudy HubComparisons

Company

AboutContactEditorial PolicyQuestion Writing PolicyTrust Center

Legal

Privacy PolicyTerms of Service

Courseiva is a free IT certification practice platform offering original exam-style practice questions, detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics for Cisco, CompTIA, Microsoft, AWS, and other technology certifications.

© 2026 Courseiva. Courseiva is operated by JTNetSolutions Ltd. All rights reserved.

Courseiva is an independent certification practice platform and is not affiliated with, endorsed by, or sponsored by Cisco, Microsoft, AWS, CompTIA, Google, ISC2, ISACA, or any other certification vendor. Vendor names and certification marks are used only to identify the exams learners are preparing for.

Certifications›300-410›Objectives›Network Logging and Syslog
Objective 403.0

Network Logging and Syslog

300-410 Practice Questions

Full Practice Test →All Objectives

300-410 Network Logging and Syslog — Practice Questions

30 questions from this objective

Question 2mediummultiple choice
Read the full network assurance explanation →

A network engineer notices that the syslog server at 10.1.1.100 is not receiving any log messages from a Cisco router running IOS-XE 16.9. The engineer has configured 'logging host 10.1.1.100' and 'logging trap debugging'. The router can ping the syslog server successfully. What is the most likely cause of the missing syslog messages?

Question 3mediummultiple choice
Read the full network assurance explanation →

An engineer is troubleshooting why syslog messages from a router are not being received by the syslog server at 192.168.1.10. The router configuration includes 'logging host 192.168.1.10' and 'logging trap 6'. The engineer runs 'debug ip packet' and sees packets destined for 192.168.1.10 being sent but no response. What should the engineer check first?

Question 4hardmultiple choice
Read the full network assurance explanation →

A network engineer is troubleshooting a router that is generating excessive syslog messages, filling up the local logging buffer and causing performance issues. The engineer wants to reduce the volume of messages sent to the remote syslog server while still capturing critical alerts locally. The current configuration includes 'logging buffered 4096 debugging' and 'logging host 10.1.1.100'. What is the best approach?

Question 5mediummultiple choice
Read the full network assurance explanation →

A router is configured with 'logging host 10.1.1.100' and 'logging trap informational'. The engineer notices that syslog messages with severity 5 (notice) are being sent, but messages with severity 6 (informational) are not. What is the most likely cause?

Question 6hardmultiple choice
Read the full network assurance explanation →

An engineer is troubleshooting a router that is not sending syslog messages to the remote server at 192.168.1.10. The configuration includes 'logging host 192.168.1.10' and 'logging trap 7'. The router can ping 192.168.1.10. The engineer runs 'show logging' and sees 'Syslog logging: enabled (0 messages dropped, 0 messages rate-limited, 0 flushes, 0 overruns)'. What is the most likely cause?

Question 7mediummultiple choice
Read the full network assurance explanation →

A router is configured to send syslog messages to two servers: 10.1.1.100 and 10.1.1.200. The engineer notices that only server 10.1.1.100 is receiving messages. The configuration shows 'logging host 10.1.1.100' and 'logging host 10.1.1.200'. Both servers are reachable via ping. What is the most likely cause?

Question 8mediummultiple choice
Read the full network assurance explanation →

An engineer is troubleshooting a router that is generating syslog messages with incorrect timestamps. The router has 'service timestamps log datetime msec' configured, but the timestamps show the wrong time zone. The router's clock is set correctly via NTP. What is the most likely cause?

Question 9hardmultiple choice
Read the full network assurance explanation →

A router is configured with 'logging host 10.1.1.100' and 'logging trap debugging'. The engineer notices that the router is sending a large number of debug messages to the syslog server, causing high CPU usage. The engineer wants to stop sending debug messages to the remote server but keep them in the local buffer. What is the best command to achieve this?

Question 10easymultiple choice
Read the full network assurance explanation →

A network engineer is troubleshooting a router that is not generating any syslog messages at all, even for critical events like interface flaps. The 'show logging' output shows 'Syslog logging: disabled'. What is the most likely cause?

Question 11mediummultiple choice
Read the full network assurance explanation →

A network engineer runs the following command on Router R1:

R1# show logging

Syslog logging: enabled (0 messages dropped, 3 messages rate-limited, 0 flushes, 0 overruns, xml disabled, small buffer) Console logging: level debugging, 37 messages logged, xml disabled, filtering disabled Monitor logging: level debugging, 0 messages logged, xml disabled, filtering disabled Buffer logging: level informational, 5 messages logged, xml disabled, filtering disabled

Logging Exception size (4096 bytes)

Count and timestamp logging messages: disabled Persistent logging: disabled

No active filter modules.

Trap logging: level informational, 0 message lines logged

Logging to 192.168.1.100 (udp port 514, audit disabled,

link up), 0 message lines logged, xml disabled, filtering disabled

Logging Source Interface: Loopback0

Log Buffer (4096 bytes):

*Mar  1 00:01:23.456: %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to up
*Mar  1 00:02:34.567: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to up

Based on this output, which statement is correct?

Question 12mediummultiple choice
Review the full routing breakdown →

A network engineer runs the following command on Router R2:

R2# show logging | include %SYS-5-CONFIG_I

*Mar  1 00:10:15.123: %SYS-5-CONFIG_I: Configured from console by console
*Mar  1 00:12:45.678: %SYS-5-CONFIG_I: Configured from console by console
*Mar  1 00:15:30.001: %SYS-5-CONFIG_I: Configured from console by console
*Mar  1 00:20:00.999: %SYS-5-CONFIG_I: Configured from console by console

Based on this output, what is the most likely problem?

Question 13hardmultiple choice
Review the full OSPF breakdown →

A network engineer runs the following command on Router R3:

R3# show logging | include %OSPF-5-ADJCHG

*Mar  1 00:05:10.123: %OSPF-5-ADJCHG: Process 1, Nbr 10.0.0.1 on GigabitEthernet0/0 from LOADING to FULL, Loading Done
*Mar  1 00:06:20.456: %OSPF-5-ADJCHG: Process 1, Nbr 10.0.0.1 on GigabitEthernet0/0 from FULL to DOWN, Neighbor Down: Dead timer expired
*Mar  1 00:07:30.789: %OSPF-5-ADJCHG: Process 1, Nbr 10.0.0.1 on GigabitEthernet0/0 from DOWN to INIT, Received Hello
*Mar  1 00:08:40.012: %OSPF-5-ADJCHG: Process 1, Nbr 10.0.0.1 on GigabitEthernet0/0 from INIT to EXSTART, Event: start
*Mar  1 00:09:50.345: %OSPF-5-ADJCHG: Process 1, Nbr 10.0.0.1 on GigabitEthernet0/0 from EXSTART to EXCHANGE, Event: Negotiation Done
*Mar  1 00:10:00.678: %OSPF-5-ADJCHG: Process 1, Nbr 10.0.0.1 on GigabitEthernet0/0 from EXCHANGE to LOADING, Event: Exchange Done
*Mar  1 00:11:10.901: %OSPF-5-ADJCHG: Process 1, Nbr 10.0.0.1 on GigabitEthernet0/0 from LOADING to FULL, Loading Done
*Mar  1 00:12:20.234: %OSPF-5-ADJCHG: Process 1, Nbr 10.0.0.1 on GigabitEthernet0/0 from FULL to DOWN, Neighbor Down: Dead timer expired

Based on this output, what is the most likely problem?

Question 14mediummultiple choice
Open the full BGP breakdown →

A network engineer runs the following command on Router R4:

R4# show logging | include %BGP-3-NOTIFICATION

*Mar  1 00:01:05.123: %BGP-3-NOTIFICATION: sent to neighbor 10.0.0.2 4/0 (Hold Timer Expired) 0 bytes
*Mar  1 00:02:10.456: %BGP-3-NOTIFICATION: received from neighbor 10.0.0.2 4/0 (Hold Timer Expired) 0 bytes
*Mar  1 00:03:15.789: %BGP-3-NOTIFICATION: sent to neighbor 10.0.0.2 4/0 (Hold Timer Expired) 0 bytes

Based on this output, what is the most likely problem?

Question 15easymultiple choice
Review the full routing breakdown →

A network engineer runs the following command on Router R5:

R5# show logging | include %LINEPROTO-5-UPDOWN

*Mar  1 00:00:10.123: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0, changed state to up
*Mar  1 00:00:20.456: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0, changed state to down
*Mar  1 00:00:30.789: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0, changed state to up
*Mar  1 00:00:40.012: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0, changed state to down
*Mar  1 00:00:50.345: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0, changed state to up
*Mar  1 00:01:00.678: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0, changed state to down

Based on this output, what is the most likely problem?

Question 16mediummultiple choice
Study the full ACL explanation →

A network engineer runs the following command on Router R6:

R6# show logging | include %SEC-6-IPACCESSLOGP

*Mar  1 00:01:15.123: %SEC-6-IPACCESSLOGP: list ACL_INBOUND denied tcp 10.0.0.100(12345) -> 192.168.1.1(80), 1 packet
*Mar  1 00:01:20.456: %SEC-6-IPACCESSLOGP: list ACL_INBOUND denied tcp 10.0.0.100(12346) -> 192.168.1.1(80), 1 packet
*Mar  1 00:01:25.789: %SEC-6-IPACCESSLOGP: list ACL_INBOUND denied tcp 10.0.0.100(12347) -> 192.168.1.1(80), 1 packet
*Mar  1 00:01:30.012: %SEC-6-IPACCESSLOGP: list ACL_INBOUND denied tcp 10.0.0.100(12348) -> 192.168.1.1(80), 1 packet

Based on this output, what is the most likely problem?

Question 17hardmultiple choice
Review the full routing breakdown →

A network engineer runs the following command on Router R7:

R7# show logging | include %SYS-2-MALLOCFAIL

*Mar  1 00:05:10.123: %SYS-2-MALLOCFAIL: Memory allocation failed for size 1024, from process 0x12345678, pool Processor
*Mar  1 00:06:20.456: %SYS-2-MALLOCFAIL: Memory allocation failed for size 2048, from process 0x12345678, pool Processor
*Mar  1 00:07:30.789: %SYS-2-MALLOCFAIL: Memory allocation failed for size 512, from process 0x12345678, pool Processor

Based on this output, what is the most likely problem?

Question 18mediummultiple choice
Review the full routing breakdown →

A network engineer runs the following command on Router R8:

R8# show logging | include %LDP-5-NBRCHG

*Mar  1 00:01:10.123: %LDP-5-NBRCHG: LDP Neighbor 10.0.0.2:0 (1) is UP
*Mar  1 00:02:20.456: %LDP-5-NBRCHG: LDP Neighbor 10.0.0.2:0 (1) is DOWN
*Mar  1 00:03:30.789: %LDP-5-NBRCHG: LDP Neighbor 10.0.0.2:0 (1) is UP
*Mar  1 00:04:40.012: %LDP-5-NBRCHG: LDP Neighbor 10.0.0.2:0 (1) is DOWN

Based on this output, what is the most likely problem?

Question 19mediummultiple choice
Read the full VPN explanation →

A network engineer runs the following command on Router R9:

R9# show logging | include %DMVPN-5-ADJCHG

*Mar  1 00:01:05.123: %DMVPN-5-ADJCHG: NHRP: Peer 10.0.0.1 on Tunnel0 is UP
*Mar  1 00:02:10.456: %DMVPN-5-ADJCHG: NHRP: Peer 10.0.0.1 on Tunnel0 is DOWN
*Mar  1 00:03:15.789: %DMVPN-5-ADJCHG: NHRP: Peer 10.0.0.1 on Tunnel0 is UP
*Mar  1 00:04:20.012: %DMVPN-5-ADJCHG: NHRP: Peer 10.0.0.1 on Tunnel0 is DOWN

Based on this output, what is the most likely problem?

Question 20mediummultiple choice
Review the full routing breakdown →

Examine the following partial router configuration:

logging buffered 16384
logging console warnings
logging monitor notifications
logging trap debugging
logging source-interface Loopback0
logging 192.168.1.100

What is the effect of this configuration?

Question 21mediummultiple choice
Review the full routing breakdown →

Given the following partial configuration on a Cisco IOS-XE router:

logging host 10.1.1.1 transport tcp port 514
logging source-interface GigabitEthernet0/1
logging on

What is missing or incorrect in this configuration?

Question 22mediummultiple choice
Full question →

Refer to the following partial configuration:

logging console informational
logging monitor debugging
logging trap errors
logging buffered 4096

Which statement is true about the logging levels?

Question 23easymultiple choice
Open the full VLAN trunking answer →

Consider the configuration snippet:

logging 192.168.1.10 vrf Mgmt-intf
logging source-interface Vlan1
logging trap 6

What is the effect of the 'logging trap 6' command?

Question 24mediummultiple choice
Full question →

Examine the following configuration:

logging host 10.1.1.1
logging host 10.1.1.2
logging host 10.1.1.3
logging origin-id hostname
logging facility local7

What is the purpose of the 'logging origin-id hostname' command?

Question 25easymultiple choice
Full question →

Given the configuration:

logging buffered 8192 warnings
logging console alerts
logging monitor critical

Which of the following is true?

Question 26easymultiple choice
Read the full network assurance explanation →

What is the default severity level for syslog messages sent to the console on a Cisco IOS device?

Question 27mediummultiple choice
Read the full network assurance explanation →

According to RFC 3164, which facility code is used by default for Cisco IOS syslog messages?

Question 28easymultiple choice
Review the full routing breakdown →

What is the default size of the logging buffer on a Cisco IOS-XE router if not explicitly configured?

Question 29mediummulti select
Read the full network assurance explanation →

Which TWO commands would a network engineer use to verify that syslog messages are being sent to a remote syslog server? (Choose TWO.)

Question 30mediummulti select
Read the full network assurance explanation →

Which TWO statements about syslog message severity levels are true? (Choose TWO.)

Question 31hardmulti select
Read the full network assurance explanation →

Which THREE configuration steps are required to send syslog messages from a Cisco router to a remote syslog server? (Choose THREE.)

More Network Logging and Syslog questions available in the full practice test.

Continue Practising →
←

Previous objective

SNMP Troubleshooting

Next objective

Embedded Event Manager (EEM)

→

All 300-410 Objectives

  • 100.Layer 3 Technologies35%
  • 101.EIGRP Troubleshooting
  • 102.OSPF Troubleshooting (v2/v3)
  • 103.BGP Troubleshooting
  • 104.Route Redistribution
  • 105.Policy-Based Routing (PBR)
  • 106.VRF-Lite
  • 107.Route Maps and Route Filtering
  • 108.Administrative Distance
  • 109.Route Summarization
  • 110.Bidirectional Forwarding Detection (BFD)
  • 200.VPN Technologies20%
  • 201.MPLS Operations
  • 202.MPLS L3VPN
  • 203.DMVPN
  • 204.IPsec Site-to-Site VPN
  • 205.IPv6 Tunneling Techniques
  • 300.Infrastructure Security20%
  • 301.Device Access Control
  • 302.IPv4 Access Control Lists
  • 303.IPv6 Traffic Filtering and uRPF
  • 304.Control Plane Policing (CoPP)
  • 305.IPv6 First Hop Security
  • 400.Infrastructure Services25%
  • 401.Device Management
  • 402.SNMP Troubleshooting
  • 403.Network Logging and Syslog
  • 404.Embedded Event Manager (EEM)
  • 405.IP SLA
  • 406.NetFlow and Flexible NetFlow
  • 407.SPAN, RSPAN, and ERSPAN
  • 408.DHCP (IPv4 and IPv6)
  • 409.NAT and PAT