mediumMultiple Choice
300-410 Practice Question: Runs the following command on Router R2: R2# show…
A network engineer runs the following command on Router R2:
R2# show logging | include %SYS-5-CONFIG_I *Mar 1 00:10:15.123: %SYS-5-CONFIG_I: Configured from console by console *Mar 1 00:12:45.678: %SYS-5-CONFIG_I: Configured from console by console *Mar 1 00:15:30.001: %SYS-5-CONFIG_I: Configured from console by console *Mar 1 00:20:00.999: %SYS-5-CONFIG_I: Configured from console by console
Based on this output, what is the most likely problem?
⚠ Common exam trap
300-410 often tests whether candidates can distinguish between syslog message types — specifically, recognizing that %SYS-5-CONFIG_I indicates configuration changes (not reloads, buffer issues, or syslog failures) and interpreting the 'from console' origin correctly.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The router is being reconfigured repeatedly from the console, which could indicate unauthorized access or a script issue.
The %SYS-5-CONFIG_I syslog message is generated whenever the running configuration is modified — in this case, 'Configured from console by console' indicates changes were made via the console line. Four such messages within ten minutes strongly suggest repeated reconfiguration, which could be unauthorized access, a misbehaving script, or a console session left open with automated commands. This is the most likely problem given the evidence.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The router has a memory leak causing frequent reloads.
Why it's wrong here
The %SYS-5-CONFIG_I messages record configuration changes made from the console, not reloads, so memory exhaustion is unsupported. A leak would instead surface as %SYS-2-MALLOCFAIL or %SYS-3-CPUHOG entries alongside rising buffer failures. Memory-leak diagnosis becomes the right focus when logging shows allocation failures during sustained traffic, not repeated console configuration events.
- ✓
The router is being reconfigured repeatedly from the console, which could indicate unauthorized access or a script issue.
Why this is correct
Each %SYS-5-CONFIG_I message is generated whenever the running configuration is replaced, and the text "from console by console" identifies the console line as the source. Four entries within ten minutes indicate repeated console-driven reconfiguration, consistent with unauthorised access or an automated script.
- ✗
The logging buffer is full and messages are being overwritten.
Why it's wrong here
A full buffer would show the earliest messages ageing out, not four identical %SYS-5-CONFIG_I entries at regular intervals. The repeated console configuration messages indicate someone is repeatedly writing configuration from the console, so the buffer is functioning normally and capturing each event.
- ✗
The syslog server is not reachable, so messages are only logged locally.
Why it's wrong here
The messages are present in the local logging buffer, so local logging works; unreachable syslog would not suppress these entries, and the console source indicates local origin. It tempts because remote logging failures do hide messages, but here the entries exist locally.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 300-410 question from scratch — 1,401 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.