How should I use these Network Logging and Syslog practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Network Logging and Syslog questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Network Logging and Syslog domain.

300-410 · topic practice

Network Logging and Syslog practice questions

Practise identifying, configuring, and troubleshooting core network services like DNS, DHCP, NAT, and NTP for the 300-410 exam.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Network Logging and Syslog

Practice 10 questions Browse domain →

What the exam tests

What to know about Network Logging and Syslog

Tests your knowledge of DNS, DHCP, NAT, and other network services configuration and troubleshooting.

DNS record types and resolution process

DHCP lease, scope, and reservation configuration

NAT and PAT for IP address translation

Network time protocol (NTP) synchronization

Why learners struggle

Why Network Logging and Syslog questions are commonly missed

Network services questions are commonly missed because candidates confuse protocol roles and port numbers. The overlap between DNS, DHCP, and NAT functions creates specific mix-ups.

·DNS vs DHCP — name resolution vs IP assignment
·NAT vs PAT — address vs port translation
·DHCP scope vs reservation — dynamic vs static
·DNS A vs AAAA — IPv4 vs IPv6 records
·NTP vs SNTP — accuracy vs simplicity
·DHCP relay vs DHCP server — forwarding vs providing

Watch out for

Common Network Logging and Syslog exam traps

▸Confusing DNS A record with CNAME for hostname mapping
▸Thinking DHCP assigns static IPs instead of dynamic leases
▸Mixing up NAT and PAT port vs address translation
▸Assuming NTP only syncs time once, not periodically

Practice set

Network Logging and Syslog questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full network assurance explanation →

A network engineer notices that the syslog server at 10.1.1.100 is not receiving any log messages from a Cisco router running IOS-XE 16.9. The engineer has configured 'logging host 10.1.1.100' and 'logging trap debugging'. The router can ping the syslog server successfully. What is the most likely cause of the missing syslog messages?

Trap 1: The syslog server is using UDP port 514, but the router is sending…

Incorrect because by default, Cisco IOS uses UDP port 514 for syslog unless explicitly configured with 'logging host <ip> transport tcp'.

Trap 2: The 'logging source-interface' is set to a loopback that is not…

Incorrect because while a missing source-interface can cause reachability issues, the default behavior uses the outgoing interface IP, which is reachable if the ping succeeds. The primary issue is more fundamental.

Trap 3: The 'logging buffered' command is overriding the remote logging…

Incorrect because 'logging buffered' only affects local buffer logging and does not disable remote syslog; both can coexist.

Study all Network Logging and Syslog common traps →

A
The 'logging on' command is not configured globally.
Correct because 'logging on' must be enabled to allow any syslog messages to be sent to a remote server. Without it, all syslog output is suppressed.
B
The syslog server is using UDP port 514, but the router is sending over TCP.
Why wrong: Incorrect because by default, Cisco IOS uses UDP port 514 for syslog unless explicitly configured with 'logging host <ip> transport tcp'.
C
The 'logging source-interface' is set to a loopback that is not advertised in the routing table.
Why wrong: Incorrect because while a missing source-interface can cause reachability issues, the default behavior uses the outgoing interface IP, which is reachable if the ping succeeds. The primary issue is more fundamental.
D
The 'logging buffered' command is overriding the remote logging configuration.
Why wrong: Incorrect because 'logging buffered' only affects local buffer logging and does not disable remote syslog; both can coexist.

Full breakdown with real-world context →

Question 2mediummultiple choice

Read the full network assurance explanation →

An engineer is troubleshooting why syslog messages from a router are not being received by the syslog server at 192.168.1.10. The router configuration includes 'logging host 192.168.1.10' and 'logging trap 6'. The engineer runs 'debug ip packet' and sees packets destined for 192.168.1.10 being sent but no response. What should the engineer check first?

Trap 1: Change the logging trap level to 7 (debugging) to ensure all…

Incorrect because the current trap level 6 (informational) already includes most messages; the issue is not severity level.

Trap 2: Add the 'logging source-interface' command to use a loopback…

Incorrect because the debug shows packets are being sent, so source interface is not the problem.

Trap 3: Configure 'logging on' if it is not already enabled.

Incorrect because if 'logging on' were disabled, the router would not send any packets; the debug confirms packets are being sent.

Study all Network Logging and Syslog common traps →

A
Verify that the syslog server is running and listening on UDP port 514.
Correct because if the server is not listening or a firewall drops the packets, the messages will never be received despite the router sending them.
B
Change the logging trap level to 7 (debugging) to ensure all messages are sent.
Why wrong: Incorrect because the current trap level 6 (informational) already includes most messages; the issue is not severity level.
C
Add the 'logging source-interface' command to use a loopback interface.
Why wrong: Incorrect because the debug shows packets are being sent, so source interface is not the problem.
D
Configure 'logging on' if it is not already enabled.
Why wrong: Incorrect because if 'logging on' were disabled, the router would not send any packets; the debug confirms packets are being sent.

Full breakdown with real-world context →

Question 3hardmultiple choice

Read the full network assurance explanation →

A network engineer is troubleshooting a router that is generating excessive syslog messages, filling up the local logging buffer and causing performance issues. The engineer wants to reduce the volume of messages sent to the remote syslog server while still capturing critical alerts locally. The current configuration includes 'logging buffered 4096 debugging' and 'logging host 10.1.1.100'. What is the best approach?

Trap 1: Change 'logging buffered 4096 debugging' to 'logging buffered 4096…

Incorrect because the goal is to reduce remote messages, not local; changing local buffer would lose detail needed for troubleshooting.

Trap 2: Remove the 'logging buffered' command to stop all local logging.

Incorrect because this would eliminate local logging entirely, which is not desired.

Trap 3: Add 'logging rate-limit 10' to limit the number of messages per…

Incorrect because rate-limiting affects all syslog output (local and remote) and may drop important messages; it does not selectively reduce remote volume.

Study all Network Logging and Syslog common traps →

A
Change 'logging buffered 4096 debugging' to 'logging buffered 4096 errors' to reduce local messages.
Why wrong: Incorrect because the goal is to reduce remote messages, not local; changing local buffer would lose detail needed for troubleshooting.
B
Configure 'logging trap errors' under the logging host configuration to limit remote messages to severity 3 and above.
Correct because 'logging trap errors' sets the remote syslog threshold to severity 3 (errors), reducing volume while keeping local debugging intact.
C
Remove the 'logging buffered' command to stop all local logging.
Why wrong: Incorrect because this would eliminate local logging entirely, which is not desired.
D
Add 'logging rate-limit 10' to limit the number of messages per second.
Why wrong: Incorrect because rate-limiting affects all syslog output (local and remote) and may drop important messages; it does not selectively reduce remote volume.

Full breakdown with real-world context →

Question 4mediummultiple choice

Read the full network assurance explanation →

A router is configured with 'logging host 10.1.1.100' and 'logging trap informational'. The engineer notices that syslog messages with severity 5 (notice) are being sent, but messages with severity 6 (informational) are not. What is the most likely cause?

Trap 1: The syslog server is dropping severity 6 messages due to its own…

Incorrect because the question states the router is not sending them; the server cannot drop what it never receives.

Trap 2: The 'logging console' command is overriding the remote logging…

Incorrect because 'logging console' controls console output, not remote syslog.

Trap 3: The router's clock is not synchronized, causing timestamp issues.

Incorrect because clock synchronization affects timestamps but does not filter messages by severity.

Study all Network Logging and Syslog common traps →

A
The 'logging trap' command is set to 5 (notice) rather than 6 (informational).
Correct because if the trap level is 5, only messages severity 0-5 are sent; severity 6 messages are excluded.
B
The syslog server is dropping severity 6 messages due to its own configuration.
Why wrong: Incorrect because the question states the router is not sending them; the server cannot drop what it never receives.
C
The 'logging console' command is overriding the remote logging level.
Why wrong: Incorrect because 'logging console' controls console output, not remote syslog.
D
The router's clock is not synchronized, causing timestamp issues.
Why wrong: Incorrect because clock synchronization affects timestamps but does not filter messages by severity.

Full breakdown with real-world context →

Question 5hardmultiple choice

Read the full network assurance explanation →

An engineer is troubleshooting a router that is not sending syslog messages to the remote server at 192.168.1.10. The configuration includes 'logging host 192.168.1.10' and 'logging trap 7'. The router can ping 192.168.1.10. The engineer runs 'show logging' and sees 'Syslog logging: enabled (0 messages dropped, 0 messages rate-limited, 0 flushes, 0 overruns)'. What is the most likely cause?

Trap 1: The 'logging on' command is missing from the configuration.

Incorrect because 'show logging' indicates syslog is enabled; if 'logging on' were missing, it would show 'logging disabled'.

Trap 2: The syslog server is using TCP, but the router is configured for…

Incorrect because by default, the router uses UDP; if the server expects TCP, the router would still send UDP packets, but the server would not receive them. However, the 'show logging' output would still show messages as sent (no drops), so this is less likely than a source-interface issue.

Trap 3: The logging buffer is full, preventing new messages from being…

Incorrect because the buffer being full does not stop the router from sending messages; it only affects local storage.

Study all Network Logging and Syslog common traps →

A
The 'logging source-interface' is configured to an interface that is administratively down.
Correct because if the source interface is down, the router cannot use its IP address, and the syslog server may drop messages from an unexpected source IP or the packets may be routed incorrectly.
B
The 'logging on' command is missing from the configuration.
Why wrong: Incorrect because 'show logging' indicates syslog is enabled; if 'logging on' were missing, it would show 'logging disabled'.
C
The syslog server is using TCP, but the router is configured for UDP.
Why wrong: Incorrect because by default, the router uses UDP; if the server expects TCP, the router would still send UDP packets, but the server would not receive them. However, the 'show logging' output would still show messages as sent (no drops), so this is less likely than a source-interface issue.
D
The logging buffer is full, preventing new messages from being generated.
Why wrong: Incorrect because the buffer being full does not stop the router from sending messages; it only affects local storage.

Full breakdown with real-world context →

Question 6mediummultiple choice

Read the full network assurance explanation →

A router is configured to send syslog messages to two servers: 10.1.1.100 and 10.1.1.200. The engineer notices that only server 10.1.1.100 is receiving messages. The configuration shows 'logging host 10.1.1.100' and 'logging host 10.1.1.200'. Both servers are reachable via ping. What is the most likely cause?

Trap 1: The router can only send to one syslog server at a time.

Incorrect because Cisco IOS supports multiple syslog servers simultaneously.

Trap 2: The 'logging host 10.1.1.200' command is missing the 'transport…

Incorrect because UDP is the default transport; specifying it is optional.

Trap 3: The second server is configured with a different severity level…

Incorrect because while possible, this would still allow some messages (e.g., emergencies) to be sent; the question implies no messages are received at all.

Study all Network Logging and Syslog common traps →

A
The syslog service on 10.1.1.200 is not running or is blocked by a firewall.
Correct because if the server is not listening or traffic is blocked, messages will not be received even though the router sends them.
B
The router can only send to one syslog server at a time.
Why wrong: Incorrect because Cisco IOS supports multiple syslog servers simultaneously.
C
The 'logging host 10.1.1.200' command is missing the 'transport udp' keyword.
Why wrong: Incorrect because UDP is the default transport; specifying it is optional.
D
The second server is configured with a different severity level using 'logging trap' under the host.
Why wrong: Incorrect because while possible, this would still allow some messages (e.g., emergencies) to be sent; the question implies no messages are received at all.

Full breakdown with real-world context →

Question 7mediummultiple choice

Read the full network assurance explanation →

An engineer is troubleshooting a router that is generating syslog messages with incorrect timestamps. The router has 'service timestamps log datetime msec' configured, but the timestamps show the wrong time zone. The router's clock is set correctly via NTP. What is the most likely cause?

Trap 1: The NTP server is not providing timezone information.

Incorrect because NTP provides UTC time; timezone must be configured locally.

Trap 2: The 'service timestamps log' command should use 'localtime' instead…

Incorrect because 'datetime' includes the date and time; 'localtime' is not a valid keyword.

Trap 3: The syslog server is overwriting the timestamps with its own.

Incorrect because the issue is observed on the router's own logs, not on the server.

Study all Network Logging and Syslog common traps →

A
The 'clock timezone' command is not configured on the router.
Correct because without a timezone configuration, the router uses UTC, so timestamps will be offset from the local time even if NTP is synced.
B
The NTP server is not providing timezone information.
Why wrong: Incorrect because NTP provides UTC time; timezone must be configured locally.
C
The 'service timestamps log' command should use 'localtime' instead of 'datetime'.
Why wrong: Incorrect because 'datetime' includes the date and time; 'localtime' is not a valid keyword.
D
The syslog server is overwriting the timestamps with its own.
Why wrong: Incorrect because the issue is observed on the router's own logs, not on the server.

Full breakdown with real-world context →

Question 8hardmultiple choice

Read the full network assurance explanation →

A router is configured with 'logging host 10.1.1.100' and 'logging trap debugging'. The engineer notices that the router is sending a large number of debug messages to the syslog server, causing high CPU usage. The engineer wants to stop sending debug messages to the remote server but keep them in the local buffer. What is the best command to achieve this?

Trap 1: Configure 'no logging trap debugging' globally.

Incorrect because this would change the global trap level, affecting all logging destinations including local buffer if not overridden.

Trap 2: Use 'undebug all' to stop all debug output.

Incorrect because this stops debug generation entirely, which may not be desired for local troubleshooting.

Trap 3: Set 'logging buffered 4096 notifications' to limit local buffer to…

Incorrect because this would reduce local logging detail, which the engineer wants to preserve.

Study all Network Logging and Syslog common traps →

A
Configure 'no logging trap debugging' globally.
Why wrong: Incorrect because this would change the global trap level, affecting all logging destinations including local buffer if not overridden.
B
Configure 'logging host 10.1.1.100 trap notifications' to set the remote threshold to severity 5.
Correct because this command sets the severity level for that specific host only, allowing local logging to remain at debugging.
C
Use 'undebug all' to stop all debug output.
Why wrong: Incorrect because this stops debug generation entirely, which may not be desired for local troubleshooting.
D
Set 'logging buffered 4096 notifications' to limit local buffer to severity 5.
Why wrong: Incorrect because this would reduce local logging detail, which the engineer wants to preserve.

Full breakdown with real-world context →

Question 9easymultiple choice

Read the full network assurance explanation →

A network engineer is troubleshooting a router that is not generating any syslog messages at all, even for critical events like interface flaps. The 'show logging' output shows 'Syslog logging: disabled'. What is the most likely cause?

Trap 1: The logging buffer is full and needs to be cleared.

Incorrect because a full buffer does not disable syslog; it only prevents new messages from being stored locally.

Trap 2: The router has run out of memory to generate syslog messages.

Incorrect because memory exhaustion would cause other symptoms, and 'show logging' would not show 'disabled'.

Trap 3: The 'logging host' command is missing, so no destination is…

Incorrect because even without a remote host, local logging to buffer or console would still work if 'logging on' is enabled.

Study all Network Logging and Syslog common traps →

A
The 'logging on' command is not configured.
Correct because 'logging on' globally enables syslog; without it, no messages are produced.
B
The logging buffer is full and needs to be cleared.
Why wrong: Incorrect because a full buffer does not disable syslog; it only prevents new messages from being stored locally.
C
The router has run out of memory to generate syslog messages.
Why wrong: Incorrect because memory exhaustion would cause other symptoms, and 'show logging' would not show 'disabled'.
D
The 'logging host' command is missing, so no destination is configured.
Why wrong: Incorrect because even without a remote host, local logging to buffer or console would still work if 'logging on' is enabled.

Full breakdown with real-world context →

Question 10mediummultiple choice

Read the full network assurance explanation →

A network engineer runs the following command on Router R1:

R1# show logging

Syslog logging: enabled (0 messages dropped, 3 messages rate-limited, 0 flushes, 0 overruns, xml disabled, small buffer) Console logging: level debugging, 37 messages logged, xml disabled, filtering disabled Monitor logging: level debugging, 0 messages logged, xml disabled, filtering disabled Buffer logging: level informational, 5 messages logged, xml disabled, filtering disabled

Logging Exception size (4096 bytes)

Count and timestamp logging messages: disabled Persistent logging: disabled

No active filter modules.

Trap logging: level informational, 0 message lines logged

Logging to 192.168.1.100 (udp port 514, audit disabled,

link up), 0 message lines logged, xml disabled, filtering disabled

Logging Source Interface: Loopback0

Log Buffer (4096 bytes):

*Mar  1 00:01:23.456: %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to up
*Mar  1 00:02:34.567: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to up

Based on this output, which statement is correct?

Trap 1: The syslog server at 192.168.1.100 is receiving messages because…

The link is up, but 0 message lines have been logged to the trap, meaning no messages have been sent to the server.

Trap 2: Buffer logging is set to debugging level, so all debug messages are…

Buffer logging is set to informational, not debugging.

Trap 3: The logging buffer size is 4096 bytes, which is sufficient to store…

The buffer size is 4096 bytes, but it is small and may overwrite older messages if many are logged; the output does not indicate that it is sufficient.

Study all Network Logging and Syslog common traps →

A
The syslog server at 192.168.1.100 is receiving messages because the link is up.
Why wrong: The link is up, but 0 message lines have been logged to the trap, meaning no messages have been sent to the server.
B
Buffer logging is set to debugging level, so all debug messages are stored in the buffer.
Why wrong: Buffer logging is set to informational, not debugging.
C
Console logging is set to debugging level, meaning all debug messages will appear on the console.
The output explicitly shows 'Console logging: level debugging', so all messages at debugging level and below will be displayed on the console.
D
The logging buffer size is 4096 bytes, which is sufficient to store all messages without overwriting.
Why wrong: The buffer size is 4096 bytes, but it is small and may overwrite older messages if many are logged; the output does not indicate that it is sufficient.

Full breakdown with real-world context →

Question 11mediummultiple choice

Read the full network assurance explanation →

A network engineer runs the following command on Router R2:

R2# show logging | include %SYS-5-CONFIG_I

*Mar  1 00:10:15.123: %SYS-5-CONFIG_I: Configured from console by console
*Mar  1 00:12:45.678: %SYS-5-CONFIG_I: Configured from console by console
*Mar  1 00:15:30.001: %SYS-5-CONFIG_I: Configured from console by console
*Mar  1 00:20:00.999: %SYS-5-CONFIG_I: Configured from console by console

Based on this output, what is the most likely problem?

Trap 1: The router has a memory leak causing frequent reloads.

The messages indicate configuration changes, not reloads.

Trap 2: The logging buffer is full and messages are being overwritten.

The output shows specific messages; there is no indication of buffer overflow.

Trap 3: The syslog server is not reachable, so messages are only logged…

The output does not mention syslog server configuration or reachability.

Study all Network Logging and Syslog common traps →

A
The router has a memory leak causing frequent reloads.
Why wrong: The messages indicate configuration changes, not reloads.
B
The router is being reconfigured repeatedly from the console, which could indicate unauthorized access or a script issue.
Multiple %SYS-5-CONFIG_I messages from the console suggest repeated configuration changes, which is abnormal and could be a security issue or a misconfigured automation script.
C
The logging buffer is full and messages are being overwritten.
Why wrong: The output shows specific messages; there is no indication of buffer overflow.
D
The syslog server is not reachable, so messages are only logged locally.
Why wrong: The output does not mention syslog server configuration or reachability.

Full breakdown with real-world context →

Question 12hardmultiple choice

Review the full OSPF breakdown →

A network engineer runs the following command on Router R3:

R3# show logging | include %OSPF-5-ADJCHG

*Mar  1 00:05:10.123: %OSPF-5-ADJCHG: Process 1, Nbr 10.0.0.1 on GigabitEthernet0/0 from LOADING to FULL, Loading Done
*Mar  1 00:06:20.456: %OSPF-5-ADJCHG: Process 1, Nbr 10.0.0.1 on GigabitEthernet0/0 from FULL to DOWN, Neighbor Down: Dead timer expired
*Mar  1 00:07:30.789: %OSPF-5-ADJCHG: Process 1, Nbr 10.0.0.1 on GigabitEthernet0/0 from DOWN to INIT, Received Hello
*Mar  1 00:08:40.012: %OSPF-5-ADJCHG: Process 1, Nbr 10.0.0.1 on GigabitEthernet0/0 from INIT to EXSTART, Event: start
*Mar  1 00:09:50.345: %OSPF-5-ADJCHG: Process 1, Nbr 10.0.0.1 on GigabitEthernet0/0 from EXSTART to EXCHANGE, Event: Negotiation Done
*Mar  1 00:10:00.678: %OSPF-5-ADJCHG: Process 1, Nbr 10.0.0.1 on GigabitEthernet0/0 from EXCHANGE to LOADING, Event: Exchange Done
*Mar  1 00:11:10.901: %OSPF-5-ADJCHG: Process 1, Nbr 10.0.0.1 on GigabitEthernet0/0 from LOADING to FULL, Loading Done
*Mar  1 00:12:20.234: %OSPF-5-ADJCHG: Process 1, Nbr 10.0.0.1 on GigabitEthernet0/0 from FULL to DOWN, Neighbor Down: Dead timer expired

Based on this output, what is the most likely problem?

Trap 1: The OSPF process is misconfigured with mismatched area IDs.

If area IDs mismatched, the neighbor would not reach FULL at all; the adjacency goes through all states, indicating correct area configuration.

Trap 2: The OSPF dead timer is set too high, causing slow convergence.

A high dead timer would make the neighbor take longer to go down, but the pattern shows quick transitions, suggesting a short timer or actual connectivity loss.

Trap 3: The router is running out of memory, causing OSPF process restarts.

There is no indication of memory issues; the OSPF process is running and forming adjacencies repeatedly.

Study all Network Logging and Syslog common traps →

A
The OSPF process is misconfigured with mismatched area IDs.
Why wrong: If area IDs mismatched, the neighbor would not reach FULL at all; the adjacency goes through all states, indicating correct area configuration.
B
There is a Layer 1 or Layer 2 issue causing intermittent connectivity on GigabitEthernet0/0.
The dead timer expiration indicates that hello packets are not received in time, which is often due to flapping interfaces or high error rates.
C
The OSPF dead timer is set too high, causing slow convergence.
Why wrong: A high dead timer would make the neighbor take longer to go down, but the pattern shows quick transitions, suggesting a short timer or actual connectivity loss.
D
The router is running out of memory, causing OSPF process restarts.
Why wrong: There is no indication of memory issues; the OSPF process is running and forming adjacencies repeatedly.

Full breakdown with real-world context →

Question 13mediummultiple choice

Open the full BGP breakdown →

A network engineer runs the following command on Router R4:

R4# show logging | include %BGP-3-NOTIFICATION

*Mar  1 00:01:05.123: %BGP-3-NOTIFICATION: sent to neighbor 10.0.0.2 4/0 (Hold Timer Expired) 0 bytes
*Mar  1 00:02:10.456: %BGP-3-NOTIFICATION: received from neighbor 10.0.0.2 4/0 (Hold Timer Expired) 0 bytes
*Mar  1 00:03:15.789: %BGP-3-NOTIFICATION: sent to neighbor 10.0.0.2 4/0 (Hold Timer Expired) 0 bytes

Based on this output, what is the most likely problem?

Trap 1: The BGP neighbor has a mismatched autonomous system number.

A mismatched AS would cause a notification with error code 2 (open message error), not hold timer expired.

Trap 2: The BGP update interval is too short, causing excessive updates.

Update interval does not affect hold timer; keepalive timer is separate.

Trap 3: The router is configured with soft-reconfiguration inbound, causing…

Soft-reconfiguration does not cause hold timer expiration.

Study all Network Logging and Syslog common traps →

A
The BGP neighbor has a mismatched autonomous system number.
Why wrong: A mismatched AS would cause a notification with error code 2 (open message error), not hold timer expired.
B
There is a connectivity issue causing keepalive packets to be lost.
Hold timer expiration means keepalives are not received within the hold time, indicating packet loss or high delay.
C
The BGP update interval is too short, causing excessive updates.
Why wrong: Update interval does not affect hold timer; keepalive timer is separate.
D
The router is configured with soft-reconfiguration inbound, causing memory issues.
Why wrong: Soft-reconfiguration does not cause hold timer expiration.

Full breakdown with real-world context →

Question 14easymultiple choice

Read the full network assurance explanation →

A network engineer runs the following command on Router R5:

R5# show logging | include %LINEPROTO-5-UPDOWN

*Mar  1 00:00:10.123: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0, changed state to up
*Mar  1 00:00:20.456: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0, changed state to down
*Mar  1 00:00:30.789: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0, changed state to up
*Mar  1 00:00:40.012: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0, changed state to down
*Mar  1 00:00:50.345: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0, changed state to up
*Mar  1 00:01:00.678: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0, changed state to down

Based on this output, what is the most likely problem?

Trap 1: The interface is administratively down.

The interface is going up and down, not administratively down; that would show a different message.

Trap 2: The interface is configured with a high bandwidth delay product.

Bandwidth delay product does not cause flapping.

Trap 3: The router is experiencing a high CPU load due to routing updates.

High CPU might cause slow processing but not line protocol flapping every 10 seconds.

Study all Network Logging and Syslog common traps →

A
The interface is administratively down.
Why wrong: The interface is going up and down, not administratively down; that would show a different message.
B
There is a physical layer issue causing the interface to flap.
Repeated line protocol up/down messages indicate a flapping interface, typically due to physical or Layer 2 issues.
C
The interface is configured with a high bandwidth delay product.
Why wrong: Bandwidth delay product does not cause flapping.
D
The router is experiencing a high CPU load due to routing updates.
Why wrong: High CPU might cause slow processing but not line protocol flapping every 10 seconds.

Full breakdown with real-world context →

Question 15mediummultiple choice

Study the full ACL explanation →

A network engineer runs the following command on Router R6:

R6# show logging | include %SEC-6-IPACCESSLOGP

*Mar  1 00:01:15.123: %SEC-6-IPACCESSLOGP: list ACL_INBOUND denied tcp 10.0.0.100(12345) -> 192.168.1.1(80), 1 packet
*Mar  1 00:01:20.456: %SEC-6-IPACCESSLOGP: list ACL_INBOUND denied tcp 10.0.0.100(12346) -> 192.168.1.1(80), 1 packet
*Mar  1 00:01:25.789: %SEC-6-IPACCESSLOGP: list ACL_INBOUND denied tcp 10.0.0.100(12347) -> 192.168.1.1(80), 1 packet
*Mar  1 00:01:30.012: %SEC-6-IPACCESSLOGP: list ACL_INBOUND denied tcp 10.0.0.100(12348) -> 192.168.1.1(80), 1 packet

Based on this output, what is the most likely problem?

Trap 1: The ACL ACL_INBOUND is permitting traffic from 10.0.0.100 to…

The log shows denied packets, so the ACL is blocking, not permitting.

Trap 2: The router is experiencing a DoS attack from 192.168.1.1.

The source is 10.0.0.100, not 192.168.1.1.

Trap 3: The ACL ACL_INBOUND is not configured on any interface.

If it were not configured, no log messages would be generated.

Study all Network Logging and Syslog common traps →

A
The ACL ACL_INBOUND is permitting traffic from 10.0.0.100 to 192.168.1.1 on port 80.
Why wrong: The log shows denied packets, so the ACL is blocking, not permitting.
B
A host at 10.0.0.100 is attempting to access a web server at 192.168.1.1 and is being blocked by the ACL.
The log messages clearly indicate that packets from 10.0.0.100 to 192.168.1.1 port 80 are being denied by ACL ACL_INBOUND.
C
The router is experiencing a DoS attack from 192.168.1.1.
Why wrong: The source is 10.0.0.100, not 192.168.1.1.
D
The ACL ACL_INBOUND is not configured on any interface.
Why wrong: If it were not configured, no log messages would be generated.

Full breakdown with real-world context →

Question 16hardmultiple choice

Read the full network assurance explanation →

A network engineer runs the following command on Router R7:

R7# show logging | include %SYS-2-MALLOCFAIL

*Mar  1 00:05:10.123: %SYS-2-MALLOCFAIL: Memory allocation failed for size 1024, from process 0x12345678, pool Processor
*Mar  1 00:06:20.456: %SYS-2-MALLOCFAIL: Memory allocation failed for size 2048, from process 0x12345678, pool Processor
*Mar  1 00:07:30.789: %SYS-2-MALLOCFAIL: Memory allocation failed for size 512, from process 0x12345678, pool Processor

Based on this output, what is the most likely problem?

Trap 1: The router is experiencing high CPU utilization due to routing…

CPU utilization is not directly indicated by memory allocation failures.

Trap 2: The router's logging buffer is full and cannot store new messages.

Logging buffer fullness does not cause memory allocation failures.

Trap 3: The router has a hardware failure in the memory module.

While possible, software memory exhaustion is more likely than hardware failure, and the message does not indicate hardware error.

Study all Network Logging and Syslog common traps →

A
The router has a memory leak or is running out of memory in the Processor pool.
Multiple MALLOCFAIL messages indicate that the router cannot allocate memory, which is a sign of memory exhaustion or a leak.
B
The router is experiencing high CPU utilization due to routing protocol updates.
Why wrong: CPU utilization is not directly indicated by memory allocation failures.
C
The router's logging buffer is full and cannot store new messages.
Why wrong: Logging buffer fullness does not cause memory allocation failures.
D
The router has a hardware failure in the memory module.
Why wrong: While possible, software memory exhaustion is more likely than hardware failure, and the message does not indicate hardware error.

Full breakdown with real-world context →

Question 17mediummultiple choice

Read the full network assurance explanation →

A network engineer runs the following command on Router R8:

R8# show logging | include %LDP-5-NBRCHG

*Mar  1 00:01:10.123: %LDP-5-NBRCHG: LDP Neighbor 10.0.0.2:0 (1) is UP
*Mar  1 00:02:20.456: %LDP-5-NBRCHG: LDP Neighbor 10.0.0.2:0 (1) is DOWN
*Mar  1 00:03:30.789: %LDP-5-NBRCHG: LDP Neighbor 10.0.0.2:0 (1) is UP
*Mar  1 00:04:40.012: %LDP-5-NBRCHG: LDP Neighbor 10.0.0.2:0 (1) is DOWN

Based on this output, what is the most likely problem?

Trap 1: The MPLS label space is exhausted.

Label exhaustion would cause label allocation failures, not neighbor flapping.

Trap 2: The router has a mismatched LDP router ID.

A mismatched router ID would prevent the neighbor from coming up at all, not cause flapping.

Trap 3: The LDP hello interval is set too high, causing slow detection.

A high hello interval would make the session slower to detect changes, but not cause flapping.

Study all Network Logging and Syslog common traps →

A
The LDP session is flapping due to an unstable IGP route to 10.0.0.2.
LDP relies on IGP to establish and maintain neighbors; if the IGP route is flapping, LDP will also flap.
B
The MPLS label space is exhausted.
Why wrong: Label exhaustion would cause label allocation failures, not neighbor flapping.
C
The router has a mismatched LDP router ID.
Why wrong: A mismatched router ID would prevent the neighbor from coming up at all, not cause flapping.
D
The LDP hello interval is set too high, causing slow detection.
Why wrong: A high hello interval would make the session slower to detect changes, but not cause flapping.

Full breakdown with real-world context →

Question 18mediummultiple choice

Read the full VPN explanation →

A network engineer runs the following command on Router R9:

R9# show logging | include %DMVPN-5-ADJCHG

*Mar  1 00:01:05.123: %DMVPN-5-ADJCHG: NHRP: Peer 10.0.0.1 on Tunnel0 is UP
*Mar  1 00:02:10.456: %DMVPN-5-ADJCHG: NHRP: Peer 10.0.0.1 on Tunnel0 is DOWN
*Mar  1 00:03:15.789: %DMVPN-5-ADJCHG: NHRP: Peer 10.0.0.1 on Tunnel0 is UP
*Mar  1 00:04:20.012: %DMVPN-5-ADJCHG: NHRP: Peer 10.0.0.1 on Tunnel0 is DOWN

Based on this output, what is the most likely problem?

Trap 1: The NHRP hold time is set too high.

A high hold time would make the peer take longer to go down, but the pattern shows quick flapping.

Trap 2: The router has a mismatched DMVPN phase configuration.

Mismatched phases would prevent the peer from coming up at all.

Trap 3: The tunnel interface is administratively down.

If the tunnel were administratively down, no peers would come up.

Study all Network Logging and Syslog common traps →

A
The DMVPN tunnel is flapping due to an unstable IPsec SA.
DMVPN uses IPsec for encryption; if the IPsec SA is not established or is flapping, the NHRP peer will go up and down.
B
The NHRP hold time is set too high.
Why wrong: A high hold time would make the peer take longer to go down, but the pattern shows quick flapping.
C
The router has a mismatched DMVPN phase configuration.
Why wrong: Mismatched phases would prevent the peer from coming up at all.
D
The tunnel interface is administratively down.
Why wrong: If the tunnel were administratively down, no peers would come up.

Full breakdown with real-world context →

Question 19mediummultiple choice

Read the full network assurance explanation →

Examine the following partial router configuration:

logging buffered 16384
logging console warnings
logging monitor notifications
logging trap debugging
logging source-interface Loopback0
logging 192.168.1.100

What is the effect of this configuration?

Trap 1: Only syslog messages of severity 0 through 4 are sent to the server…

The trap level is 'debugging', not 'warnings'. The console level is set to warnings, but that does not affect the syslog server.

Trap 2: The syslog server receives messages with the IP address of the…

The 'logging source-interface Loopback0' overrides the source IP to be the Loopback0 address, not the outgoing interface.

Trap 3: The logging buffer stores up to 16384 syslog messages.

The buffer size is 16384 bytes, not messages. The number of messages depends on their size.

Study all Network Logging and Syslog common traps →

A
Syslog messages of severity 0 through 7 are sent to the server 192.168.1.100.
The 'logging trap debugging' command sets the syslog trap level to debugging, which includes all severities (0-7).
B
Only syslog messages of severity 0 through 4 are sent to the server 192.168.1.100.
Why wrong: The trap level is 'debugging', not 'warnings'. The console level is set to warnings, but that does not affect the syslog server.
C
The syslog server receives messages with the IP address of the outgoing interface as the source.
Why wrong: The 'logging source-interface Loopback0' overrides the source IP to be the Loopback0 address, not the outgoing interface.
D
The logging buffer stores up to 16384 syslog messages.
Why wrong: The buffer size is 16384 bytes, not messages. The number of messages depends on their size.

Full breakdown with real-world context →

Question 20mediummultiple choice

Read the full network assurance explanation →

Given the following partial configuration on a Cisco IOS-XE router:

logging host 10.1.1.1 transport tcp port 514
logging source-interface GigabitEthernet0/1
logging on

What is missing or incorrect in this configuration?

Trap 1: The configuration is correct; no changes are needed.

While syntactically correct, using TCP for syslog is unusual and many syslog servers do not support it. The question expects recognition that this is a potential issue.

Trap 2: The 'logging on' command is redundant because logging is enabled by…

'logging on' is required to enable logging; it is not redundant.

Trap 3: The port number should be 5140 for TCP syslog.

Port 514 is the default for both UDP and TCP syslog; there is no separate port for TCP.

Study all Network Logging and Syslog common traps →

A
The configuration is correct; no changes are needed.
Why wrong: While syntactically correct, using TCP for syslog is unusual and many syslog servers do not support it. The question expects recognition that this is a potential issue.
B
The 'logging on' command is redundant because logging is enabled by default.
Why wrong: 'logging on' is required to enable logging; it is not redundant.
C
The syslog server must support TCP syslog, which is not defined in RFC 3164.
RFC 3164 defines syslog over UDP. TCP syslog is defined in RFC 6587 but is not universally supported. This configuration may fail if the server does not accept TCP.
D
The port number should be 5140 for TCP syslog.
Why wrong: Port 514 is the default for both UDP and TCP syslog; there is no separate port for TCP.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Network Logging and Syslog sessions

Start a Network Logging and Syslog only practice session

Every question in these sessions is drawn from the Network Logging and Syslog domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Network Logging and Syslog questions →Mixed 300-410 session

Frequently asked questions

What does the 300-410 exam test about Network Logging and Syslog?: Tests your knowledge of DNS, DHCP, NAT, and other network services configuration and troubleshooting.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Network Logging and Syslog questions in a focused session?: Yes — the session launcher on this page draws every question from the Network Logging and Syslog domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other 300-410 topics?: Use the topic links above to move to related areas, or go back to the 300-410 question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the 300-410 exam covers. They are not copied from any real exam or dump site.

Network Logging and Syslog only

10 questions 20 questions 30 questions 50 questions

Mixed 300-410 session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All 300-410 questions Network Logging and Syslog domain overview 300-410 exam guide

Exam traps to avoid

▸Confusing DNS A record with CNAME for hostname mapping
▸Thinking DHCP assigns static IPs instead of dynamic leases
▸Mixing up NAT and PAT port vs address translation
▸Assuming NTP only syncs time once, not periodically

Network Logging and Syslog practice questions

What to know about Network Logging and Syslog

Why Network Logging and Syslog questions are commonly missed

Common Network Logging and Syslog exam traps

Network Logging and Syslog questions

A router is configured with 'logging host 10.1.1.100' and 'logging trap informational'. The engineer notices that syslog messages with severity 5 (notice) are being sent, but messages with severity 6 (informational) are not. What is the most likely cause?

An engineer is troubleshooting a router that is generating syslog messages with incorrect timestamps. The router has 'service timestamps log datetime msec' configured, but the timestamps show the wrong time zone. The router's clock is set correctly via NTP. What is the most likely cause?

A network engineer is troubleshooting a router that is not generating any syslog messages at all, even for critical events like interface flaps. The 'show logging' output shows 'Syslog logging: disabled'. What is the most likely cause?

Track your progress over time

Start a Network Logging and Syslog only practice session

Related 300-410 topic practice pages

Layer 3 Technologies practice questions

EIGRP Troubleshooting practice questions

OSPF Troubleshooting (v2/v3) practice questions

BGP Troubleshooting practice questions

Route Redistribution practice questions

Policy-Based Routing (PBR) practice questions

VRF-Lite practice questions

Route Maps and Route Filtering practice questions

Administrative Distance practice questions

Route Summarization practice questions

Bidirectional Forwarding Detection (BFD) practice questions

VPN Technologies practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid