mediumMultiple Choice
350-401 Practice Question: Is troubleshooting a problem where Cisco DNA…
A network engineer is troubleshooting a problem where Cisco DNA Center is not receiving syslog messages from a critical core switch. The switch is configured to send syslog to the DNA Center's IP address. The engineer checks the DNA Center syslog collector and finds that it is enabled. What should the engineer check next?
⚠ Common exam trap
350-401 often tests the assumption that if a service is 'enabled' and the source is 'configured,' it must be working — candidates overlook Layer 3/4 filtering (UDP 514 blocked) as the silent killer of syslog, SNMP traps, and NetFlow exports.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Verify that the syslog port (UDP 514) is not blocked by a firewall or ACL.
Syslog uses UDP port 514 by default, and if a firewall or ACL between the switch and Cisco DNA Center is blocking that port, the collector will never receive messages even though both endpoints are correctly configured. Since the collector is enabled and the switch is configured to send, the next logical troubleshooting step is verifying network path reachability for UDP 514. This is the most common cause of silent syslog failures in production.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Verify that the syslog port (UDP 514) is not blocked by a firewall or ACL.
Why this is correct
With the collector enabled and the switch configured, the remaining variable is transport. Syslog uses UDP 514, so an intervening firewall or ACL silently dropping that traffic would explain why DNA Center receives nothing despite correct endpoint configuration.
- ✗
Check if the syslog messages are in the correct format.
Why it's wrong here
DNA Center's syslog collector parses standard Cisco syslog, so message format is rarely the blocker; the switch already emits compliant messages. Format validation matters when integrating third-party or custom sources, not native Cisco devices. The actual gap is usually reachability or an access-list blocking UDP 514.
- ✗
Ensure that the switch is in the Inventory and managed by DNA Center.
Why it's wrong here
Inventory membership does not affect syslog delivery; an unmanaged device can still send syslog to the collector, so this does not explain the failure. It is tempting because DNA Center correlates telemetry with managed devices, and would be correct when troubleshooting assurance data or device health rather than raw syslog receipt.
- ✗
Restart the syslog collector service on DNA Center.
Why it's wrong here
Restarting the collector is a blind action; the service is confirmed enabled and running, so restarting changes nothing. Service restarts suit a crashed or hung collector showing errors in its logs. The stem points to transport or firewall filtering between switch and DNA Center, which a restart cannot resolve.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,923 original 350-401 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.