mediumMultiple Choice
CCNP Practice Question: Review the following IP SLA configuration on…
Review the following IP SLA configuration on Router R1:
ip sla 3
icmp-echo 10.3.3.3 frequency 30
ip sla schedule 3 life forever start-time now ip sla reaction-configuration 3 react rtt threshold-type xof 5 threshold-value 100 action-type triggerAndReset
What is the purpose of the 'threshold-type xof 5' parameter?
⚠ Common exam trap
Cisco often tests the distinction between 'xof' (consecutive violations) and 'average' or 'mean' threshold types, leading candidates to mistakenly think 'xof 5' means 5 out of the last 10 probes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It triggers an event if 5 consecutive RTT measurements exceed 100 ms.
The 'threshold-type xof 5' parameter in IP SLA triggers an action when 5 consecutive RTT measurements exceed the specified threshold of 100 ms. This is a 'consecutive violations' threshold, meaning the event fires only after a sustained pattern of failures, not based on a sliding window or time duration. The 'xof' keyword specifically indicates the number of consecutive probe results that must exceed the threshold before the reaction is triggered.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
It triggers an event if 5 out of the last 10 RTT measurements exceed 100 ms.
Why it's wrong here
This misreads the 'xof' parameter as a sliding-window or percentage condition. In Cisco IP SLA, 'xof' requires a specified number of consecutive probe failures or threshold crossings, not any 5 within the last 10 samples. With 'xof 5', exactly five successive RTT measurements must exceed 100 ms to trigger the event; a sliding window count is not how the reaction condition evaluates data.
- ✓
It triggers an event if 5 consecutive RTT measurements exceed 100 ms.
Why this is correct
The 'xof' keyword in IP SLA reaction configuration defines the number of consecutive threshold violations needed to trigger an event. Here, 'xof 5' means five RTT probe samples in a row must each exceed 100 ms; if any single probe falls back below the threshold, the consecutive counter resets to zero. Only after those five uninterrupted high measurements does the event fire.
- ✗
It triggers an event if the RTT exceeds 100 ms for 5 seconds.
Why it's wrong here
This incorrectly converts a discrete probe counter into a time-based duration. The 'xof' parameter counts individual IP SLA probe iterations, not seconds; the probe interval is configured separately and can vary, so 'xof 5' does not mean 'for 5 seconds.' It means five consecutive measurement samples must exceed the threshold, regardless of the elapsed wall-clock time between them.
- ✗
It triggers an event if the RTT exceeds 100 ms and then repeats 5 times.
Why it's wrong here
This suggests a single violation that repeats or is re-detected after the fact, but 'xof' is not a retry or repeat counter. It requires five sequential probe results to individually cross the threshold with no lower result in between; the logic is based on a consecutive streak, not on a single event being repeated. The word 'repeats' implies a temporal sequence, whereas the actual mechanism is a contiguous window of threshold-exceeding probes.
About these practice questions
One of 1,923 original 350-401 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.