CCNP Network Assurance Practice Question
A network engineer has configured a Cisco IOS IP SLA operation using ICMP echo to monitor reachability to a remote branch router. The engineer wants to correlate the results with syslog messages and SNMP traps to detect when the branch becomes unreachable. Which IP SLA configuration step is required to generate these notifications?
⚠ Common exam trap
The trap here is assuming that scheduling an IP SLA operation or using a responder automatically generates alerts, when in fact reactions are required to produce notifications.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure an IP SLA reaction with a threshold and an action such as logging or SNMP trap.
To generate syslog messages and SNMP traps based on IP SLA results, you must configure a reaction that specifies a threshold and an action. The reaction monitors the operation's return code or metrics and triggers the defined action when the condition is met. Without a reaction, the operation collects data silently, and no notifications are sent.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure the ip sla monitor operation with the tag command to enable logging.
Why it's wrong here
The tag command is used to assign a user-defined identifier to an IP SLA operation for easier management and filtering; it does not trigger syslog or SNMP notifications. Notifications require configuring a reaction with a threshold and action, not just a tag. Without a reaction, the operation still collects statistics but does not generate alerts.
- ✗
Enable IP SLA responder on the remote branch router and configure the operation to use the responder.
Why it's wrong here
The IP SLA responder is used for operations that require a remote device to respond to probes, such as UDP jitter or ICMP path echo. While using a responder can improve accuracy, it does not generate syslog or SNMP notifications on the source device. Notifications are controlled by reactions, not by the responder.
- ✓
Configure an IP SLA reaction with a threshold and an action such as logging or SNMP trap.
Why this is correct
This is correct because IP SLA reactions define what happens when a monitored threshold is breached. By specifying a reaction condition (e.g., timeout) and an action (e.g., logging, SNMP trap), the device generates syslog messages and SNMP traps when the SLA operation fails or exceeds the threshold. This directly enables correlation with monitoring systems.
- ✗
Configure the ip sla schedule command with the life forever option to ensure continuous monitoring.
Why it's wrong here
The schedule command determines when the operation starts and how long it runs. The life forever option makes the operation run indefinitely, but it does not produce any notifications. Scheduling is necessary for the operation to execute, but it is separate from the alerting mechanism, which requires reactions.
About these practice questions
Courseiva writes every 350-401 question from scratch — 1,923 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.