hardMultiple SelectObjective-mapped
Configuring Syslog Severity Levels for Remote and Console Logging
An engineer must ensure that all syslog messages with severity level 4 (warning) and higher are sent to a remote syslog server at 10.1.1.100, while also logging messages of severity 6 (informational) to the console. Which TWO configuration commands are required? (Choose TWO.)
Quick Answer
The correct commands are logging host 10.1.1.100 trap 4 and logging console 6. This configuration works because the trap keyword on the logging host command sets the severity filter for remote syslog messages, so specifying level 4 ensures that only warnings (severity 4) and higher (0–3) are sent to the server, while the default trap level of 6 would have allowed informational messages as well. The logging console 6 command overrides the default console severity of 7 (debugging), restricting console output to informational (6) and higher, which matches the requirement. On the Cisco CCNP ENARSI 300-410 exam, this tests your understanding of syslog severity levels and the distinct commands for remote versus local logging—a common trap is confusing the trap keyword with the console keyword or forgetting that the default trap level is 6. A helpful memory tip: think of the trap as a “net” that catches only the most critical messages for the remote server, while the console is your local “loudspeaker” that you can turn down to a specific level.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
logging host 10.1.1.100 trap 4
The 'logging host' command with the 'trap' keyword sets the severity filter for remote logging; default trap level is 6 (informational), so to limit to level 4 and higher, the trap level must be set to 4. The 'logging console' command controls console logging; default is level 7 (debugging), so setting it to 6 allows informational and higher (0-6). The 'logging buffered' command affects buffer logging, not console. The 'logging source-interface' sets the source IP but does not filter severity. The 'logging monitor' affects terminal lines, not console.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
logging host 10.1.1.100 trap 4
Why this is correct
Correct. This sets the remote syslog server and limits messages sent to severity 4 (warning) and higher (0-4).
- ✓
logging console 6
Why this is correct
Correct. This sets console logging to severity 6 (informational) and higher (0-6), meeting the requirement.
- ✗
logging buffered 6
Why it's wrong here
Incorrect. This affects buffered logging (to internal buffer), not console logging.
- ✗
logging source-interface Loopback0
Why it's wrong here
Incorrect. This sets the source IP address for syslog packets but does not filter severity.
- ✗
logging monitor 4
Why it's wrong here
Incorrect. This sets the severity for terminal line (monitor) logging, not console.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 300-410 question from scratch — 1,966 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 300-410
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A network engineer is troubleshooting a router that is generating excessive syslog messages, filling up the local logging buffer and causing performance issues. The engineer wants to reduce the volume of messages sent to the remote syslog server while still capturing critical alerts locally. The current configuration includes 'logging buffered 4096 debugging' and 'logging host 10.1.1.100'. What is the best approach?
hard- A.Change 'logging buffered 4096 debugging' to 'logging buffered 4096 errors' to reduce local messages.
- ✓ B.Configure 'logging trap errors' under the logging host configuration to limit remote messages to severity 3 and above.
- C.Remove the 'logging buffered' command to stop all local logging.
- D.Add 'logging rate-limit 10' to limit the number of messages per second.
Why B: The 'logging trap errors' command limits the severity of syslog messages sent to the remote syslog server (10.1.1.100) to level 3 (errors) and above, reducing the volume of remote messages while leaving the local 'logging buffered 4096 debugging' unchanged to capture critical alerts locally. This directly addresses the requirement to reduce remote syslog traffic without affecting local logging of critical alerts.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.