Syslog practice questions

The device must run Syslog before NTP can sync

Why wrong: Syslog is unrelated.

NTP requires a trunk port on the management VLAN

Why wrong: NTP needs IP reachability, not a trunk specifically.

The clock can sync only if DNS is configured

Why wrong: NTP uses IP connectivity; DNS is optional if using addresses.

It assigns the Syslog server an IP address.

Why wrong: This is wrong because NTP does not provide IP addressing.

It replaces the need for a Syslog server.

Why wrong: This is wrong because NTP and Syslog serve different roles.

It encrypts every Syslog message automatically.

Why wrong: This is wrong because NTP is not a Syslog encryption mechanism.

Firewall: Detects and alerts on suspicious activity

Why wrong: This is incorrect because detection and alerting on suspicious activity is the primary function of an Intrusion Detection System (IDS), not a firewall. Firewalls focus on filtering traffic based on rules, not on analyzing patterns for threats.

Firewall: Prevents and blocks intrusions in real time

Why wrong: This is incorrect because real-time prevention and blocking of intrusions is the function of an Intrusion Prevention System (IPS). While a firewall can block traffic, it does not analyze traffic for intrusion signatures like an IPS does.

Firewall: Authenticates users and manages access rights

Why wrong: This is incorrect because authentication and access rights management are functions of AAA (Authentication, Authorization, and Accounting) services, not a firewall. Firewalls may integrate with AAA but do not primarily manage user access.

SIEM: Manages network device configurations and monitors device health via SNMP.

Why wrong: This is incorrect because SIEM does not manage device configurations or use SNMP for health monitoring; those functions belong to network management systems like SNMP-based tools.

SIEM: Analyzes network traffic flows to identify bandwidth usage and application performance.

Why wrong: This is incorrect because traffic flow analysis is the role of NetFlow or similar flow monitoring tools, not SIEM.

SIEM: Controls user access to network resources based on roles and policies.

Why wrong: This is incorrect because role-based access control (RBAC) is the mechanism for managing user permissions, not SIEM.

Packet loss causes intermittent connectivity

Why wrong: Packet loss can cause intermittent connectivity, but the question asks for the most likely service involved. Packet loss is a symptom, not a service. The service most associated with packet loss is not a single service; it is a network condition.

Bandwidth congestion slows transfers

Why wrong: Bandwidth congestion can slow transfers, but it is a network condition, not a specific service. The question asks for the service involved, and bandwidth congestion is not a service.

Jitter affects real-time services

Why wrong: Jitter affects real-time services like VoIP and video, but the question asks for the most likely service involved. Jitter is a symptom, not a service. The service affected is real-time communication, but the symptom itself is jitter.

SNMP

Why wrong: The AI agent is the autonomous entity that makes decisions, but it does not directly interact with external systems without a tool-calling mechanism.

CLI scripting

Why wrong: Closed-loop remediation is the overall process of detecting, analyzing, and fixing issues automatically, but it does not specify how the agent interacts with external systems.

Syslog

Why wrong: Prompt engineering involves crafting inputs to guide the AI model's responses, but it does not enable the agent to execute commands or query devices.

The interface received a superior BPDU and became the root port.

Why wrong: This is wrong because the event shown is a port-security violation, not an STP role change.

The hub forced the interface to become a routed port.

Why wrong: This is wrong because connecting a hub does not convert a switchport into a Layer 3 interface.

DHCP snooping always shuts a port when a hub is attached.

Why wrong: This is wrong because the specific event shown is from port security, not DHCP snooping.

restrict

Why wrong: Restrict provides similar forwarding behavior but tracks and reports violations.

shutdown

Why wrong: Shutdown places the port into err-disabled state after a violation.

shutdown vlan

Why wrong: Shutdown vlan is not the standard switchport port-security violation mode being tested here.

DHCP

Why wrong: DHCP assigns IP settings to a client; it does not resolve names.

NTP

Why wrong: NTP synchronizes time.

Syslog

Why wrong: Syslog is used for logging, not name resolution.

logging on logging trap informational logging source-interface GigabitEthernet0/1 logging host 10.0.0.2 service timestamps log datetime

Why wrong: This is incorrect because 'logging trap informational' sets the severity level to 6 (informational), which includes messages below the required notifications level (5). Also, the source interface is set to GigabitEthernet0/1 (LAN), which is not the interface facing the syslog server.

logging on logging trap 5 logging source-interface GigabitEthernet0/0 logging 10.0.0.2 service timestamps

Why wrong: This is incorrect because 'logging trap 5' uses the numeric severity level, which is acceptable, but 'logging 10.0.0.2' is incomplete; the correct command is 'logging host 10.0.0.2'. Also, 'service timestamps' without specifying 'log datetime' may not enable timestamps for log messages properly.

logging on logging trap notifications logging source-interface GigabitEthernet0/1 logging host 10.0.0.2 service timestamps debug datetime

Why wrong: This is incorrect because 'service timestamps debug datetime' enables timestamps only for debug messages, not for log messages. Also, the source interface is set to GigabitEthernet0/1 (LAN), which is not the interface facing the syslog server.

DHCP and STP

Why wrong: This is wrong because neither DHCP nor STP provides centralized logging with synchronized timestamps.

PAT and EtherChannel

Why wrong: This is wrong because NAT and link bundling do not solve centralized log collection and time correlation.

ARP and CDP

Why wrong: This is wrong because neighbor resolution and discovery do not provide the required logging and timestamp control.

DNS

Why wrong: Distractor.

SNMP

Why wrong: Distractor.

CDP

Why wrong: Distractor.

The logging buffer is full, preventing new informational and debug messages from being sent to the syslog server.

Why wrong: The exhibit shows 0 overruns and a buffer size of 4096 bytes with no indication of overflow. The buffer is not full, and even if it were, buffer fullness only affects local storage, not trap transmission.

The syslog server IP address 192.168.100.50 is unreachable from the router.

Why wrong: The exhibit does not indicate reachability issues; the logging line shows 'Logging to 192.168.100.50' and even a stop message at the end, which suggests the session existed. If the server were unreachable, severity 0–3 messages would also fail to be sent, but they are successfully logged (150 messages logged).

Console logging is disabled, so only severity 3 and lower messages appear.

Why wrong: Console logging is shown as 'level debugging' (enabled). Even if console logging were disabled, it would not affect syslog server forwarding; trap logging controls messages sent to the server.

Level 1 – Alert: Immediate action needed

Why wrong: This is incorrect because Level 1 is Alert, which means immediate action is needed, but the description 'System is unusable' belongs to Level 0 (Emergency).

Level 2 – Critical: Critical conditions

Why wrong: This is incorrect because Level 2 is Critical, but the description 'Immediate action needed' belongs to Level 1 (Alert).

Level 3 – Error: Error conditions

Why wrong: This is incorrect because Level 3 is Error, but the description 'Critical conditions' belongs to Level 2 (Critical).

Syslog is primarily used to assign IP addresses to hosts.

Why wrong: This is wrong because DHCP, not Syslog, assigns addressing information to clients.

Syslog automatically prevents switching loops.

Why wrong: This is wrong because loop prevention is handled by STP, not Syslog.

Syslog replaces the need for any monitoring system.

Why wrong: This is wrong because Syslog is useful, but it does not eliminate the value of broader monitoring tools.