CCNA AI and Network Operations Practice Question
Exhibit
R1#show running-config | include ntp|logging ntp server 192.0.2.1 logging host 203.0.113.10 logging trap debugging ! R1#show ntp status Clock is unsynchronized, stratum 16, no reference clock R1#show ntp associations address ref clock st when poll reach delay offset disp *~192.0.2.1 .INIT. 16 - 64 0 0.0 0.0 0.0 ~198.51.100.1 .INIT. 16 - 64 0 0.0 0.0 0.0
You are connected to R1, a branch router that must synchronize time with the NTP server at 198.51.100.1 (reachable via G0/0) and send critical syslog messages (severity 0-4) to the logging server at 203.0.113.10. The current configuration has NTP pointing to a wrong server and syslog set to debug level, flooding the server. Correct the NTP server, set the NTP source interface to Loopback0 (10.10.10.1/32), and adjust the syslog trap level so that only emergencies through warnings are logged.
⚠ Common exam trap
Watch out for two separate configuration items: NTP and syslog. Ensure you update both the NTP server IP and source interface, and set the correct syslog trap level. Common traps include forgetting to change the NTP server IP, using the wrong source interface, or setting the wrong syslog severity level.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ntp server 198.51.100.1 source Loopback0; logging trap warnings
The NTP server was misconfigured to 192.0.2.1, which is unreachable, leaving the router at stratum 16. The correct NTP server is 198.51.100.1, so the ntp server command must be updated. The source interface should be Loopback0 for reachability consistency. The syslog trap level was set to debugging (level 7), which sends all messages; it should be changed to warnings (level 4) to filter only severity 0-4. Verification includes checking NTP synchronization and syslog configuration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
ntp server 198.51.100.1 source Loopback0; logging trap warnings
Why this is correct
This command sets the NTP server to the correct IP (198.51.100.1) with Loopback0 as the source interface, and changes the syslog trap level to warnings (severity 4), which logs messages with severity 0-4 (emergencies through warnings).
- ✗
ntp server 198.51.100.1 source G0/0; logging trap errors
Why it's wrong here
The NTP server IP is correct, but this command uses G0/0 as the source interface instead of Loopback0. If G0/0 goes down or its IP changes, NTP packets will be sourced from an unstable or incorrect address, breaking synchronization. Additionally, 'logging trap errors' restricts syslog to severity 0-3 (emergencies through errors), so warnings (severity 4) are never sent to the syslog server. To meet the requirement, the source must be Loopback0 and the trap level must be 'warnings'.
- ✗
ntp server 192.0.2.1 source Loopback0; logging trap warnings
Why it's wrong here
This option uses the correct source interface (Loopback0) and the correct trap level ('warnings'), but it points NTP to 192.0.2.1, which is a TEST-NET-1 documentation address that is not routable on the live network. The required NTP server is 198.51.100.1, another documentation address that the lab topology actually uses, so this command would never synchronize. Because the device cannot reach the wrong server, the NTP client will remain unsynchronized, and no amount of correct sourcing or logging will fix that.
- ✗
ntp server 198.51.100.1 source Loopback0; logging trap debugging
Why it's wrong here
The NTP server IP and source interface are both correct, making the clock-sync part of the command valid. However, 'logging trap debugging' sets the syslog threshold to severity 7, which forwards every message from emergencies (0) down to debug-level (7). The requirement only asks for severities 0-4 (emergencies through warnings), so this config sends a flood of unnecessary debug messages to the syslog server, wasting bandwidth and storage. To match exactly, the trap level must be 'warnings', which stops at severity 4.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓ntp server 198.51.100.1 source Loopback0; logging trap warningsCorrect answer▾
Why this is correct
This command sets the NTP server to the correct IP (198.51.100.1) with Loopback0 as the source interface, and changes the syslog trap level to warnings (severity 4), which logs messages with severity 0-4 (emergencies through warnings).
✗ntp server 198.51.100.1 source G0/0; logging trap errorsWrong answer — click to see why▾
Why this is wrong here
The source interface must be Loopback0 for consistency, and the trap level should be warnings (4) to include warnings.
Why candidates choose this
Candidates might think G0/0 is the correct source since it's the interface that reaches the NTP server, but using a loopback ensures reachability even if G0/0 goes down.
✗ntp server 192.0.2.1 source Loopback0; logging trap warningsWrong answer — click to see why▾
Why this is wrong here
The NTP server address must be updated to 198.51.100.1; 192.0.2.1 is the misconfigured server.
Why candidates choose this
Candidates might forget to change the NTP server IP and only adjust the source interface and syslog level.
✗ntp server 198.51.100.1 source Loopback0; logging trap debuggingWrong answer — click to see why▾
Why this is wrong here
The trap level should be warnings (4), not debugging (7). Debugging sends all messages, flooding the server.
Why candidates choose this
Candidates might confuse the logging levels or think debugging is needed for troubleshooting, but the question explicitly requires only severities 0-4.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Interpreting Syslog Messages, Severity Levels, and Facilities
Key term
Flooding
Flooding is a network switching technique where a switch sends incoming frames out through all its ports except the one it received the frame from, to ensure the frame reaches its destination when the switch does not know the correct port.
Key term
Interface
An interface is a point of connection or interaction between two systems, devices, or software components that allows them to exchange information or signals.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.