300-410 Network Logging and Syslog Practice Test 2 — 15 Questions

Question 1

A network engineer runs the following command on Router R7:

R7# show logging | include %SYS-2-MALLOCFAIL

*Mar  1 00:05:10.123: %SYS-2-MALLOCFAIL: Memory allocation failed for size 1024, from process 0x12345678, pool Processor
*Mar  1 00:06:20.456: %SYS-2-MALLOCFAIL: Memory allocation failed for size 2048, from process 0x12345678, pool Processor
*Mar  1 00:07:30.789: %SYS-2-MALLOCFAIL: Memory allocation failed for size 512, from process 0x12345678, pool Processor

Based on this output, what is the most likely problem?

Accepted Answer

The router has a memory leak or is running out of memory in the Processor pool.. The output shows memory allocation failures in the Processor pool. This indicates that the router is running low on memory, which can cause various issues including process crashes, inability to allocate buffers, and overall instability. The process ID 0x12345678 is likely a specific process that is consuming memory or failing to allocate.

Answer

The router is experiencing high CPU utilization due to routing protocol updates.

Answer

The router's logging buffer is full and cannot store new messages.

Answer

The router has a hardware failure in the memory module.

Question 2

A network engineer runs the following command on Router R8:

R8# show logging | include %LDP-5-NBRCHG

*Mar  1 00:01:10.123: %LDP-5-NBRCHG: LDP Neighbor 10.0.0.2:0 (1) is UP
*Mar  1 00:02:20.456: %LDP-5-NBRCHG: LDP Neighbor 10.0.0.2:0 (1) is DOWN
*Mar  1 00:03:30.789: %LDP-5-NBRCHG: LDP Neighbor 10.0.0.2:0 (1) is UP
*Mar  1 00:04:40.012: %LDP-5-NBRCHG: LDP Neighbor 10.0.0.2:0 (1) is DOWN

Based on this output, what is the most likely problem?

Accepted Answer

The LDP session is flapping due to an unstable IGP route to 10.0.0.2.. The output shows LDP neighbor 10.0.0.2 flapping between UP and DOWN. This indicates instability in the LDP session, often due to a flapping IGP route (since LDP depends on IGP reachability), or a misconfiguration of LDP parameters such as hello interval or hold time.

Answer

The MPLS label space is exhausted.

Answer

The router has a mismatched LDP router ID.

Answer

The LDP hello interval is set too high, causing slow detection.

Question 3

A network engineer runs the following command on Router R9:

R9# show logging | include %DMVPN-5-ADJCHG

*Mar  1 00:01:05.123: %DMVPN-5-ADJCHG: NHRP: Peer 10.0.0.1 on Tunnel0 is UP
*Mar  1 00:02:10.456: %DMVPN-5-ADJCHG: NHRP: Peer 10.0.0.1 on Tunnel0 is DOWN
*Mar  1 00:03:15.789: %DMVPN-5-ADJCHG: NHRP: Peer 10.0.0.1 on Tunnel0 is UP
*Mar  1 00:04:20.012: %DMVPN-5-ADJCHG: NHRP: Peer 10.0.0.1 on Tunnel0 is DOWN

Based on this output, what is the most likely problem?

Accepted Answer

The DMVPN tunnel is flapping due to an unstable IPsec SA.. The output shows NHRP peer flapping on Tunnel0, indicating that the DMVPN tunnel is unstable. This is often due to a flaking physical interface, IPsec SA expiration, or routing issues. The peer 10.0.0.1 is going up and down repeatedly.

Answer

The NHRP hold time is set too high.

Answer

The router has a mismatched DMVPN phase configuration.

Answer

The tunnel interface is administratively down.

Question 4

Examine the following partial router configuration:

logging buffered 16384
logging console warnings
logging monitor notifications
logging trap debugging
logging source-interface Loopback0
logging 192.168.1.100

What is the effect of this configuration?

Accepted Answer

Syslog messages of severity 0 through 7 are sent to the server 192.168.1.100.. This configuration sets up logging with different severity levels for different destinations. The 'logging trap debugging' sends all messages (severity 0-7) to the syslog server at 192.168.1.100, while console gets only warnings (severity 4) and monitor gets notifications (severity 5). The buffer is set to 16384 bytes.

Answer

Only syslog messages of severity 0 through 4 are sent to the server 192.168.1.100.

Answer

The syslog server receives messages with the IP address of the outgoing interface as the source.

Answer

The logging buffer stores up to 16384 syslog messages.

Question 5

Given the following partial configuration on a Cisco IOS-XE router:

logging host 10.1.1.1 transport tcp port 514
logging source-interface GigabitEthernet0/1
logging on

What is missing or incorrect in this configuration?

Accepted Answer

The syslog server must support TCP syslog, which is not defined in RFC 3164.. By default, syslog uses UDP port 514. When using TCP transport, the syslog server must be configured to accept TCP connections, and this is not a common configuration. The configuration itself is syntactically correct, but the question tests knowledge that TCP transport for syslog is non-standard and may not work with typical syslog servers.

Answer

The configuration is correct; no changes are needed.

Answer

The 'logging on' command is redundant because logging is enabled by default.

Answer

The port number should be 5140 for TCP syslog.

Question 6

Refer to the following partial configuration:

logging console informational
logging monitor debugging
logging trap errors
logging buffered 4096

Which statement is true about the logging levels?

Accepted Answer

The console receives messages of severity 0 through 6.. Logging levels: emergencies (0), alerts (1), critical (2), errors (3), warnings (4), notifications (5), informational (6), debugging (7). The trap level 'errors' means only messages severity 0-3 are sent to syslog servers. Console 'informational' means 0-6. Monitor 'debugging' means 0-7. Buffer defaults to debugging if not specified, but here it is set to 4096 bytes without a level, so it defaults to debugging.

Answer

The monitor receives messages of severity 0 through 6.

Answer

The syslog server receives messages of severity 0 through 7.

Answer

The buffer stores messages of severity 0 through 6.

Question 7

Consider the configuration snippet:

logging 192.168.1.10 vrf Mgmt-intf
logging source-interface Vlan1
logging trap 6

What is the effect of the 'logging trap 6' command?

Accepted Answer

Messages of severity 0 through 6 are sent to the syslog server.. The 'logging trap' command accepts either a severity level name or number. Level 6 corresponds to 'informational'. This means messages with severity 0-6 are sent to the syslog server.

Answer

Only messages of severity 6 are sent to the syslog server.

Answer

Messages of severity 6 through 7 are sent to the syslog server.

Answer

The number 6 is invalid; only named levels are accepted.

Question 8

Examine the following configuration:

logging host 10.1.1.1
logging host 10.1.1.2
logging host 10.1.1.3
logging origin-id hostname
logging facility local7

What is the purpose of the 'logging origin-id hostname' command?

Accepted Answer

It causes the syslog messages to include the router's hostname as the origin, overriding the default IP address.. The 'logging origin-id' command sets the origin identifier in syslog messages. When set to 'hostname', the router's hostname is used as the origin ID instead of the default (which is the IP address of the source interface). This helps identify the source of messages in a multi-device environment.

Answer

It sets the syslog message format to include the hostname in the timestamp field.

Answer

It configures the router to send syslog messages only when the hostname changes.

Answer

It is used to authenticate syslog messages using the hostname as a key.

Question 9

Given the configuration:

logging buffered 8192 warnings
logging console alerts
logging monitor critical

Which of the following is true?

Accepted Answer

The logging buffer stores messages of severity 0 through 4.. The buffer is set to 8192 bytes with level warnings (0-4). Console is alerts (0-2). Monitor is critical (0-3). Note that the buffer size is in bytes, not messages.

Answer

The console displays messages of severity 0 through 3.

Answer

The monitor receives messages of severity 0 through 4.

Answer

The buffer can store up to 8192 syslog messages.

Question 10

What is the default severity level for syslog messages sent to the console on a Cisco IOS device?

Accepted Answer

Debugging (level 7). By default, the console logging level is 'debugging' (severity 7), meaning all messages from 0 to 7 are displayed on the console. This is a common fact for ENARSI.

Answer

Informational (level 6)

Answer

Warnings (level 4)

Answer

Notifications (level 5)

Question 11

According to RFC 3164, which facility code is used by default for Cisco IOS syslog messages?

Accepted Answer

Local7. RFC 3164 defines facility codes. Cisco IOS uses local7 (facility 23) as the default for syslog messages, though this can be changed with the 'logging facility' command.

Answer

Local0

Answer

User

Answer

Syslog

Question 12

What is the default size of the logging buffer on a Cisco IOS-XE router if not explicitly configured?

Accepted Answer

4096 bytes. The default logging buffer size on most Cisco IOS-XE platforms is 4096 bytes. This is a standard default value that candidates should know.

Answer

8192 bytes

Answer

16384 bytes

Answer

No buffer is allocated by default.

Question 13

Which TWO commands would a network engineer use to verify that syslog messages are being sent to a remote syslog server? (Choose TWO.)

Accepted Answer

show logging. The 'show logging' command displays the current logging configuration, including the syslog server address and whether logging is enabled. The 'debug logging' command is not valid; the correct command to see real-time syslog messages is 'terminal monitor' after enabling logging. 'show run | include logging' shows the running config lines for logging. 'ping' tests reachability but not syslog functionality. 'show ip route' checks routing but not logging.

Answer

debug logging

Answer

ping <syslog-server-ip>

Answer

show ip route

Question 14

Which TWO statements about syslog message severity levels are true? (Choose TWO.)

Accepted Answer

Severity level 0 (emergencies) is the most critical and indicates system instability.. Syslog severity levels range from 0 (emergencies) to 7 (debugging). Level 0 is the most critical, and level 7 is the least critical. Level 5 is 'notifications', not 'warnings'; warnings are level 4. Level 6 is 'informational'. Level 3 is 'errors'.

Answer

Severity level 5 (warnings) is less severe than level 4 (notifications).

Answer

Severity level 6 (informational) is used for system error messages.

Answer

Severity level 3 (errors) is more critical than level 2 (critical).

Question 15

Which THREE configuration steps are required to send syslog messages from a Cisco router to a remote syslog server? (Choose THREE.)

Accepted Answer

Configure the syslog server IP address using the 'logging <ip-address>' command.. To send syslog messages to a remote server, you must enable logging globally, specify the server address, and set the logging trap level (or use default). Setting the source interface is optional but recommended. Configuring NTP is not required for syslog. Enabling SNMP is unrelated.

Answer

Set the logging source interface using 'logging source-interface <interface>'.

Answer

Configure NTP to ensure accurate timestamps in syslog messages.