CCNA Network Services and Security Practice Question
Exhibit
Requirement: send warnings, errors, critical, alerts, and emergencies
Exhibit: An engineer wants a device to send only warning messages and more critical events to a syslog server. Which logging level should be configured?
⚠ Common exam trap
A frequent exam trap is selecting 'logging trap debugging' or 'informational' because these options seem to provide comprehensive logging. However, these levels include all messages, even low-priority informational and debug messages, which can overwhelm the syslog server and make it difficult to identify critical issues. Another trap is misunderstanding the syslog severity numbering, assuming higher numbers mean higher severity, when in fact, lower numbers indicate more critical events. This confusion leads to incorrect trap level configuration and ineffective monitoring.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
logging trap warnings
Syslog severity levels include lower numbers for more severe events. Warning is level 4, so setting logging trap warnings sends level 4, 3, 2, 1, and 0 messages.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
logging trap debugging
Why it's wrong here
Debugging is severity level 7, the lowest on the syslog scale, so 'logging trap debugging' causes every syslog message generated by the device to be sent, from level 0 emergencies through level 7 debugging. This is maximally inclusive and obviously exceeds the engineer's goal of only warning messages, because it forwards all debug output and every other severity class.
When this WOULD be correct
In a different scenario where an engineer needs to troubleshoot a network issue and requires detailed information about system operations, 'logging trap debugging' would be appropriate to capture all levels of logs for comprehensive analysis.
- ✓
logging trap warnings
Why this is correct
The syslog severity scale numbers levels from 0 (emergencies) to 7 (debugging), with warnings at level 4. Issuing 'logging trap warnings' instructs the device to send only messages at severity 4 and above (i.e., 0-4), which precisely matches the engineer's requirement to send only warning-level and more severe messages while excluding notifications and lower. This is the exact command for filtering to warnings and critical alerts.
- ✗
logging trap notifications
Why it's wrong here
Notifications sit at severity level 5, which is one step less severe than warnings. When you configure 'logging trap notifications', the device sends levels 0 through 5—so it includes all warning and more severe messages plus the lower-severity notification messages. That adds an extra level of messages beyond the engineer's stated requirement, making the filter too broad rather than limiting the output to warnings only.
When this WOULD be correct
In a different scenario where the requirement is to send all notifications, including warnings, to a syslog server without filtering, 'logging trap notifications' would be the correct answer. For example, if the question asked for all significant events, including warnings and alerts, this option would be appropriate.
- ✗
logging trap informational
Why it's wrong here
The 'logging trap informational' command sets the trap filter to severity 6, which means the device will transmit all messages from level 0 through 6—including informational and all less severe messages. Because informational is two steps below warnings, this would forward far more messages than requested, including notifications and routine informational notices that the engineer does not want.
When this WOULD be correct
If the question specified that the engineer wanted to monitor all events, including informational messages, to gain a comprehensive view of the system's status, then 'logging trap informational' would be the correct choice. This could be relevant in a scenario where detailed logging is necessary for troubleshooting.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓logging trap warningsCorrect answer▾
Why this is correct
The syslog severity scale numbers levels from 0 (emergencies) to 7 (debugging), with warnings at level 4. Issuing 'logging trap warnings' instructs the device to send only messages at severity 4 and above (i.e., 0-4), which precisely matches the engineer's requirement to send only warning-level and more severe messages while excluding notifications and lower. This is the exact command for filtering to warnings and critical alerts.
✗logging trap debuggingWrong answer — click to see why▾
Why this is wrong here
The option 'logging trap debugging' is incorrect because it captures all messages, including debug-level logs, which are not needed for sending only warnings and more critical events.
★ When this WOULD be the correct answer
In a different scenario where an engineer needs to troubleshoot a network issue and requires detailed information about system operations, 'logging trap debugging' would be appropriate to capture all levels of logs for comprehensive analysis.
Why candidates choose this
Candidates may choose this option due to a misunderstanding of logging levels, thinking that debugging information could provide valuable insights, even when only warnings and critical events are required.
✗logging trap notificationsWrong answer — click to see why▾
Why this is wrong here
The option 'logging trap notifications' is incorrect because it captures notifications, which include both warnings and more critical events, but does not limit the output to only warnings and critical events as specified in the question.
★ When this WOULD be the correct answer
In a different scenario where the requirement is to send all notifications, including warnings, to a syslog server without filtering, 'logging trap notifications' would be the correct answer. For example, if the question asked for all significant events, including warnings and alerts, this option would be appropriate.
Why candidates choose this
Candidates may be tempted to choose this option because 'notifications' sounds like it would include important messages, leading them to believe it aligns with the need to capture critical events, despite it being broader than required.
✗logging trap informationalWrong answer — click to see why▾
Why this is wrong here
The 'logging trap informational' level captures all informational messages, which includes less critical events that the engineer does not want to send to the syslog server. This option does not meet the requirement of only sending warning and more critical messages.
★ When this WOULD be the correct answer
If the question specified that the engineer wanted to monitor all events, including informational messages, to gain a comprehensive view of the system's status, then 'logging trap informational' would be the correct choice. This could be relevant in a scenario where detailed logging is necessary for troubleshooting.
Why candidates choose this
Candidates may choose this option because they associate 'informational' with important system messages and believe that capturing all events would provide a fuller picture, not realizing it contradicts the specific requirement of filtering out less critical logs.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.