CCNA Network Services and Security Practice Question
Exhibit
Targets: Log collector 10.10.10.50 Time source 10.10.10.60
An engineer wants all devices to send logs to 10.10.10.50 and also stamp those logs with consistent time from 10.10.10.60. Which two configurations are required on a Cisco device?
⚠ Common exam trap
A common exam trap is selecting commands related to SNMP or DHCP relay, such as 'snmp-server host' or 'ip helper-address', mistakenly believing they configure logging or time synchronization. Candidates may also choose 'service timestamps log localtime' expecting it to standardize timestamps, but without NTP synchronization, timestamps remain inconsistent across devices. The trap lies in confusing the purpose of these commands with syslog and NTP functions. The question specifically requires centralized logging and consistent timestamps, which only 'logging host' and 'ntp server' commands fulfill together.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
logging host 10.10.10.50
One configuration points the device to the syslog collector, and the other points it to the NTP server. The requirement is about centralized logging and accurate timestamps, so both services must be configured. Option E, 'service timestamps log localtime', is a valid command but it only sets the timestamp format to local time; without an NTP server, timestamps will not be consistent across devices.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
logging host 10.10.10.50
Why this is correct
The logging host 10.10.10.50 command designates a remote syslog server to receive all generated log messages. This is the primary mechanism for sending logs to a collector, as the device will forward syslog messages at the configured severity levels. Without this statement, logs are only stored locally, so this command directly fulfills the requirement to send logs to 10.10.10.50.
- ✓
ntp server 10.10.10.60
Why this is correct
The ntp server 10.10.10.60 command configures the device to synchronize its system clock with an NTP time source. Accurate, consistent time is essential for correlating logs across multiple devices because syslog messages rely on timestamps to reconstruct event sequences. While this does not send logs to a collector, it ensures the logs that are sent have a trustworthy and uniform time reference.
- ✗
ip helper-address 10.10.10.50
Why it's wrong here
The ip helper-address 10.10.10.50 command enables a router to forward broadcast traffic, such as DHCP requests, to a specific unicast server. This is a broadcast relay mechanism, completely unrelated to syslog logging; it does not send syslog messages or configure any log destination. Consequently, using this command would have no effect on sending logs to the collector and is the wrong choice.
When this WOULD be correct
In a scenario where the question asks for configurations to enable DHCP relay for clients on a different subnet, specifying 'ip helper-address 10.10.10.50' would be correct if 10.10.10.50 were the DHCP server's address.
- ✗
snmp-server host 10.10.10.60
Why it's wrong here
The snmp-server host 10.10.10.60 command sets the destination for SNMP traps and informs, which are network management notifications about device status and events. SNMP is a separate protocol from syslog and is not used to transmit log messages or to synchronize time. Therefore, this command would not enable any device to send logs to the intended collector and is incorrect for the stated goal.
When this WOULD be correct
If the question asked for configuring SNMP monitoring for devices to report to a management server at 10.10.10.60, then this option would be correct. For instance, a question could specify that the engineer needs to set up SNMP traps for monitoring device health.
- ✗
service timestamps log localtime
Why it's wrong here
The service timestamps log localtime command adds human-readable local time to each syslog message, but it does not establish a time source or send logs anywhere. If devices are not synchronized via NTP, their local clocks can drift, making timestamps inconsistent and log correlation unreliable. While useful for readability, this command alone cannot satisfy the need to send logs to the collector.
When this WOULD be correct
In a different scenario where the requirement is to configure local logging with timestamps for troubleshooting purposes, a question might ask for the command to enable local timestamps on log messages without needing to send logs to a remote server or synchronize time from another device.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓logging host 10.10.10.50Correct answer▾
Why this is correct
The logging host 10.10.10.50 command designates a remote syslog server to receive all generated log messages. This is the primary mechanism for sending logs to a collector, as the device will forward syslog messages at the configured severity levels. Without this statement, logs are only stored locally, so this command directly fulfills the requirement to send logs to 10.10.10.50.
✗ip helper-address 10.10.10.50Wrong answer — click to see why▾
Why this is wrong here
The 'ip helper-address' command is used to forward broadcast packets, typically for DHCP, and does not relate to logging or time synchronization, making it irrelevant for the requirements of this question.
★ When this WOULD be the correct answer
In a scenario where the question asks for configurations to enable DHCP relay for clients on a different subnet, specifying 'ip helper-address 10.10.10.50' would be correct if 10.10.10.50 were the DHCP server's address.
Why candidates choose this
Candidates may confuse the need for log forwarding with the use of 'ip helper-address' due to familiarity with network address forwarding concepts, leading them to incorrectly associate it with the logging requirement.
✗snmp-server host 10.10.10.60Wrong answer — click to see why▾
Why this is wrong here
This option is wrong because it configures an SNMP trap destination to 10.10.10.60, which is unrelated to logging or time-stamping logs as required by the question.
★ When this WOULD be the correct answer
If the question asked for configuring SNMP monitoring for devices to report to a management server at 10.10.10.60, then this option would be correct. For instance, a question could specify that the engineer needs to set up SNMP traps for monitoring device health.
Why candidates choose this
Candidates may choose this option because they recognize the importance of SNMP in network management and mistakenly associate it with logging and time synchronization tasks.
✗service timestamps log localtimeWrong answer — click to see why▾
Why this is wrong here
This command enables timestamp logging with local time, but without NTP synchronization, timestamps will not be consistent across devices, failing the requirement for accurate timestamps.
★ When this WOULD be the correct answer
In a different scenario where the requirement is to configure local logging with timestamps for troubleshooting purposes, a question might ask for the command to enable local timestamps on log messages without needing to send logs to a remote server or synchronize time from another device.
Why candidates choose this
Candidates might choose this option because they recognize the importance of timestamps in logging and assume that configuring local timestamps is relevant to log management, leading to confusion about the specific requirements of the question.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Device File Management with SFTP and SCP
Key term
NTP
Network Time Protocol is a networking protocol used to synchronize the clocks of computers and devices over a network to a common time reference.
Key term
Syslog
Syslog is a standard protocol used to send and store log messages from network devices and servers to a central logging server for monitoring and troubleshooting.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.