N10-009 Network Operations Practice Question
A network administrator wants to centrally collect and analyze event logs from routers, switches, and firewalls. Which protocol is most commonly used for sending log messages from network devices to a central log server?
⚠ Common exam trap
The N10-009 exam often tests the distinction between Syslog (for event logs) and SNMP traps (for alerts/status changes), leading candidates to mistakenly choose SNMP because both involve sending data from devices to a server.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Syslog
Syslog (RFC 5424) is the standard protocol for sending event messages from network devices like routers, switches, and firewalls to a central log server. It uses UDP port 514 by default and provides a structured format with facility codes and severity levels, enabling centralized collection and analysis of logs. This makes it the most commonly used protocol for this purpose.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SNMP
Why it's wrong here
Simple Network Management Protocol (SNMP) is an application-layer protocol used for managing and monitoring network devices. While SNMP can send 'traps' for specific, high-level events like an interface going down, its primary role is to poll devices for performance metrics and configuration data stored in Management Information Bases (MIBs). It is not designed for the comprehensive, granular event logging that Syslog provides, which captures detailed operational messages and security events.
When this WOULD be correct
A question asking which protocol is used to monitor device health metrics (e.g., CPU load, interface errors) by polling or receiving traps from network devices would have SNMP as the correct answer.
- ✓
Syslog
Why this is correct
Syslog is the industry-standard protocol for collecting system and event messages from network devices like routers and switches. It enables administrators to centralize logs from various sources onto a dedicated server, facilitating comprehensive analysis for security auditing, troubleshooting, and compliance. This centralized approach is crucial for correlating events across the network and identifying potential issues or breaches efficiently.
- ✗
NetFlow
Why it's wrong here
NetFlow is a network protocol developed by Cisco for collecting IP traffic information as it enters or exits an interface. It aggregates data into 'flows' based on common characteristics like source/destination IP, ports, and protocol, providing insights into *who* is talking to *whom* and *how much* data is transferred. However, NetFlow focuses on traffic statistics and flow patterns, not detailed system event logs such as authentication failures or configuration changes.
When this WOULD be correct
A question asking which protocol is used to monitor network traffic patterns, bandwidth usage, or application performance across routers and switches would have NetFlow as the correct answer.
- ✗
ICMP
Why it's wrong here
The Internet Control Message Protocol (ICMP) is a network layer protocol primarily used by network devices to send error messages and operational information. It is fundamental for diagnostic utilities like `ping` to test reachability and `traceroute` to map network paths by reporting issues such as unreachable hosts or expired time-to-live values. ICMP's function is limited to control and error reporting, making it unsuitable for the continuous transmission and central collection of detailed system event logs.
When this WOULD be correct
A question asking which protocol is used to test connectivity between devices or to report network errors (e.g., destination unreachable) would have ICMP as the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓SyslogCorrect answer▾
Why this is correct
Syslog is the industry-standard protocol for collecting system and event messages from network devices like routers and switches. It enables administrators to centralize logs from various sources onto a dedicated server, facilitating comprehensive analysis for security auditing, troubleshooting, and compliance. This centralized approach is crucial for correlating events across the network and identifying potential issues or breaches efficiently.
✗SNMPWrong answer — click to see why▾
Why this is wrong here
SNMP is used for monitoring and managing network devices via polling or traps, but it is not designed for centralized collection and analysis of event logs; syslog is the standard protocol for log message transport.
★ When this WOULD be the correct answer
A question asking which protocol is used to monitor device health metrics (e.g., CPU load, interface errors) by polling or receiving traps from network devices would have SNMP as the correct answer.
Why candidates choose this
Candidates may confuse SNMP traps with syslog messages, as both can send alerts from devices, but SNMP is for management data, not event logs.
✗NetFlowWrong answer — click to see why▾
Why this is wrong here
NetFlow is designed for network traffic flow analysis and accounting, not for collecting and analyzing event logs from network devices. It exports metadata about IP flows, not system event messages.
★ When this WOULD be the correct answer
A question asking which protocol is used to monitor network traffic patterns, bandwidth usage, or application performance across routers and switches would have NetFlow as the correct answer.
Why candidates choose this
Candidates may confuse NetFlow with Syslog because both involve sending data from network devices to a central server, but they serve different purposes: NetFlow for traffic analysis, Syslog for event logging.
✗ICMPWrong answer — click to see why▾
Why this is wrong here
ICMP is used for network diagnostics (e.g., ping, traceroute) and error reporting, not for centralized log collection from network devices.
★ When this WOULD be the correct answer
A question asking which protocol is used to test connectivity between devices or to report network errors (e.g., destination unreachable) would have ICMP as the correct answer.
Why candidates choose this
Candidates may confuse ICMP's role in network monitoring with log collection, or think that any network protocol can be used for sending event data.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Network Documentation and Diagrams
Key term
UDP
UDP (User Datagram Protocol) is a communication protocol that sends data quickly without first checking if the receiver is ready or if the data arrived correctly.
Key term
User Datagram Protocol
User Datagram Protocol (UDP) is a fast, connectionless network protocol that sends data without first checking if the receiver is ready or if the data arrived safely.
About these practice questions
One of 464 original N10-009 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.