CCNA Syslog centralized logging Practice Question
Exhibit
Example message: %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to down
A network operations team wants centralized logging from routers and switches and also wants meaningful severity filtering. Which two statements about syslog are correct?
⚠ Common exam trap
Be careful not to confuse syslog's use of UDP with TCP, and remember that syslog can send to multiple servers.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Devices can send log messages to a remote syslog server for central storage
Syslog provides centralized event reporting by allowing devices to send log messages to a remote server (option A is correct). Severity levels enable filtering based on event seriousness (option B is correct). Option C is incorrect because syslog does not assign IP addresses dynamically—that is the role of DHCP. Option D is incorrect because syslog logs events and does not replace SNMP counters, which remain the primary method for collecting interface statistics.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Devices can send log messages to a remote syslog server for central storage
Why this is correct
Syslog uses UDP port 514 by default to stream event messages from network devices to a centralized server, enabling aggregation, correlation, and long-term retention across the entire infrastructure. Local logging buffers are volatile and size-limited, so remote storage is critical for troubleshooting, compliance, and forensic analysis after a failure or security incident.
- ✓
Severity levels allow filtering based on how serious an event is
Why this is correct
Syslog messages are categorized into eight severity levels, from Emergency (0) to Debug (7), allowing administrators to set thresholds such as 'logging trap 4' to filter what gets sent or stored. This prioritizes serious events like link flaps or interface down states while suppressing routine informational or debug noise, ensuring that operations teams focus on actionable alerts.
- ✗
Syslog is used to assign IP addresses dynamically to endpoints
Why it's wrong here
Dynamic IP address assignment is performed by DHCP, which leases addresses from a configured pool and delivers client options like subnet mask and gateway, not by syslog. Syslog is purely an observability protocol used to forward log messages, and it has no mechanism or role in network address allocation, so this option incorrectly conflates a logging service with DHCP.
When this WOULD be correct
In a question asking about protocols that assign IP addresses dynamically to endpoints, such as 'Which protocol assigns IP addresses automatically to devices on a network?', 'Syslog' would be incorrect, but if the question were about logging, this option would not apply. However, for a scenario where the question is about centralized logging, this option is never correct.
- ✗
Syslog entries replace SNMP counters for interface statistics
Why it's wrong here
Syslog is event-driven and reports discrete occurrences such as interface errors or configuration changes, while SNMP continuously tracks cumulative counters like bytes transmitted, packets dropped, and CRC errors from the MIB. These serve different purposes: SNMP provides quantitative traffic statistics for capacity planning and performance monitoring, whereas syslog delivers qualitative event notifications, so syslog cannot substitute for SNMP counters.
When this WOULD be correct
In a question asking 'Which protocol can be used to collect interface error counters from network devices?', SNMP would be correct, not syslog. Alternatively, if the question asked 'Which logging method can send event notifications to a central server?', syslog would be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Devices can send log messages to a remote syslog server for central storageCorrect answer▾
Why this is correct
Syslog uses UDP port 514 by default to stream event messages from network devices to a centralized server, enabling aggregation, correlation, and long-term retention across the entire infrastructure. Local logging buffers are volatile and size-limited, so remote storage is critical for troubleshooting, compliance, and forensic analysis after a failure or security incident.
✗Syslog is used to assign IP addresses dynamically to endpointsWrong answer — click to see why▾
Why this is wrong here
Syslog is a logging protocol for network devices, not a protocol for dynamic IP address assignment. DHCP is used for that purpose.
★ When this WOULD be the correct answer
In a question asking about protocols that assign IP addresses dynamically to endpoints, such as 'Which protocol assigns IP addresses automatically to devices on a network?', 'Syslog' would be incorrect, but if the question were about logging, this option would not apply. However, for a scenario where the question is about centralized logging, this option is never correct.
Why candidates choose this
Candidates may confuse syslog with DHCP because both involve network services and the term 'log' might be misassociated with 'login' or 'assignment' processes.
✗Syslog entries replace SNMP counters for interface statisticsWrong answer — click to see why▾
Why this is wrong here
Syslog is a logging protocol for event messages, not a replacement for SNMP counters. SNMP is used for collecting interface statistics, while syslog provides text-based log entries.
★ When this WOULD be the correct answer
In a question asking 'Which protocol can be used to collect interface error counters from network devices?', SNMP would be correct, not syslog. Alternatively, if the question asked 'Which logging method can send event notifications to a central server?', syslog would be correct.
Why candidates choose this
Candidates may confuse syslog with SNMP because both are used for network monitoring and can provide information about device status, leading to the mistaken belief that syslog can replace SNMP counters.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Device File Management with SFTP and SCP
Key term
DHCP
Dynamic Host Configuration Protocol (DHCP) automatically assigns IP addresses and network settings to devices on a network, so they can communicate without manual configuration.
Key term
Interface
An interface is a point of connection or interaction between two systems, devices, or software components that allows them to exchange information or signals.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.