CCNA Network Services and Security Practice Question
Exhibit
R1# show logging
Syslog logging: enabled (0 messages dropped, 0 messages rate-limited, 0 flushes, 0 overruns)
Console logging: level debugging, 355 messages logged
Monitor logging: level debugging, 0 messages logged
Buffer logging: level debugging, 355 messages logged
Trap logging: level errors (3), 150 messages logged
Logging to 192.168.100.50
Log Buffer (4096 bytes):
*Feb 28 10:14:55.123: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0/1, changed state to down
*Feb 28 10:15:22.123: %SYS-6-CLOCKUPDATE: System clock has been updated from 10:15:22 UTC Feb 28 2025 to 10:15:22 UTC Feb 28 2025, configured from console by vty0 (192.168.1.10)
*Feb 28 10:15:24.456: %LINK-3-UPDOWN: Interface GigabitEthernet0/0/1, changed state to down
*Feb 28 10:16:01.789: %SYS-7-DEBUG: Message from debug command interface GigabitEthernet0/0/1 held down
*Feb 28 10:16:10.111: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0/1, changed state to up
*Feb 28 10:16:15.222: %LINK-3-UPDOWN: Interface GigabitEthernet0/0/1, changed state to up
*Feb 28 10:16:30.333: %SYS-6-LOGGINGHOST_STARTSTOP: Logging to host 192.168.100.50 stoppedRefer to the exhibit. A network engineer is troubleshooting an issue where syslog messages at severity 6 (informational) and severity 7 (debugging) are not being sent to the syslog server at 192.168.100.50, even though the device appears to generate these messages locally. Based on the exhibit, what is the most likely cause?
⚠ Common exam trap
Cisco often tests the distinction between different logging destinations (console, monitor, buffer, trap) and their independent severity thresholds, so candidates mistakenly assume that if messages appear locally (e.g., in the buffer), they must also be sent to the syslog server.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The trap logging level is set to errors (severity 3), filtering out informational and debug messages.
The exhibit shows that the logging trap level is configured to 'errors' (severity 3). This means only syslog messages with a severity of 0 (emergencies) through 3 (errors) are sent to the syslog server. Informational (severity 6) and debugging (severity 7) messages are filtered out because they are below the configured trap threshold. This directly explains why those messages are not reaching the server, even though they are generated locally.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The logging buffer is full, preventing new informational and debug messages from being sent to the syslog server.
Why it's wrong here
The exhibit shows 0 overruns and a buffer size of 4096 bytes with no indication of overflow. The buffer is not full, and even if it were, buffer fullness only affects local storage, not trap transmission.
- ✗
The syslog server IP address 192.168.100.50 is unreachable from the router.
Why it's wrong here
The exhibit does not indicate reachability issues; the logging line shows 'Logging to 192.168.100.50' and even a stop message at the end, which suggests the session existed. If the server were unreachable, severity 0–3 messages would also fail to be sent, but they are successfully logged (150 messages logged).
- ✓
The trap logging level is set to errors (severity 3), filtering out informational and debug messages.
Why this is correct
The 'Trap logging: level errors (3)' line in the exhibit explicitly limits syslog messages sent to the syslog server to severity 0–3. Informational (6) and debug (7) are higher in numeric value (less severe) and are dropped by this filter.
- ✗
Console logging is disabled, so only severity 3 and lower messages appear.
Why it's wrong here
Console logging is actually enabled at level debugging (severity 7) in the exhibit, so the premise is false. Even if console logging were disabled, it would only suppress messages displayed on the console port; it would have no effect on the syslog server forwarding. The syslog server receives messages based on the trap logging severity filter, which is configured as 'errors' (severity 3), so only severity 0–3 messages are forwarded.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓The trap logging level is set to errors (severity 3), filtering out informational and debug messages.Correct answer▾
Why this is correct
The 'Trap logging: level errors (3)' line in the exhibit explicitly limits syslog messages sent to the syslog server to severity 0–3. Informational (6) and debug (7) are higher in numeric value (less severe) and are dropped by this filter.
✗The logging buffer is full, preventing new informational and debug messages from being sent to the syslog server.Wrong answer — click to see why▾
Why this is wrong here
Candidates may associate local buffer behavior with remote logging, but the buffer is just local storage, independent of trap forwarding.
✗The syslog server IP address 192.168.100.50 is unreachable from the router.Wrong answer — click to see why▾
Why this is wrong here
A reachability problem would affect all severities equally, not selectively filter only informational and debug messages.
✗Console logging is disabled, so only severity 3 and lower messages appear.Wrong answer — click to see why▾
Why this is wrong here
Candidates may confuse console and trap logging, but each destination has its own independent severity level.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.