SNMP & Syslog Practice Questions

Answers and explanations appear when you work through the set above.

1. An administrator changes a router's SNMP engine ID after SNMPv3 users were already configured, and those users immediately stop being able to authenticate. Why does this happen?

   • The engine ID determines which UDP port SNMP listens on, and changing it moves the listener
   • SNMPv3 authentication and privacy key material is derived (localized) from the engine ID, so changing it invalidates the previously computed keys for existing users
   • The engine ID is only cosmetic and should not affect any users
   • SNMPv3 does not use an engine ID at all

2. Which SNMPv3 security level provides message authentication but sends the payload unencrypted?

   • noAuthNoPriv
   • authNoPriv
   • authPriv
   • authOnly

3. An SNMPv3 user is configured with authPriv but a monitoring platform reports messages are being received and parsed without any decryption step being needed. What is the likely misconfiguration?

   • The user was actually provisioned at a lower security level (such as authNoPriv or noAuthNoPriv) than intended on the device
   • SNMPv3 always sends messages in cleartext regardless of security level
   • The monitoring platform is ignoring privacy entirely by design
   • authPriv requires a separate community string

4. Which statement correctly distinguishes SNMP polling from SNMP traps and informs?

   • Polling is initiated by the network management station to retrieve data; traps and informs are unsolicited notifications originated by the managed device
   • Polling requires TCP port 179, the same port BGP uses
   • Traps always carry encrypted payloads regardless of SNMP version
   • Informs cannot be acknowledged by the receiving manager

5. Which behavior differentiates an SNMP inform from an SNMP trap?

   • Informs are sent only over UDP 162 while traps use UDP 161
   • Informs require the receiving manager to send back an acknowledgment, and the agent retransmits if none arrives; traps are fire-and-forget with no acknowledgment
   • Traps can only be generated by SNMPv3 agents
   • Informs are only supported for interface state changes

6. SNMP polling works correctly from one network management station but fails from a second station on the same subnet. Routing between the stations and the device is confirmed fine. What should be checked besides the network path?

   • The device's SNMP community/user access restrictions, views, and any host or ACL statement limiting which managers are permitted
   • The EIGRP variance configuration on the device
   • The DMVPN tunnel authentication key
   • The OSPF virtual link configuration

7. What is the purpose of an SNMPv3 'view' in combination with a group?

   • It restricts which portion of the MIB tree a group's users are permitted to read or write
   • It defines the encryption algorithm used for that group only
   • It sets the UDP port the group listens on
   • It determines the engine ID assigned to the group

8. A device is configured to log to a remote syslog server at severity level 'warnings' (severity 4). Which additional messages will also be sent to that server?

   • Only messages at exactly severity 4
   • All messages at severity 4 and every numerically lower (more severe) level, such as errors, critical, alerts, and emergencies
   • Only informational and debugging messages
   • No messages will be sent because warnings is too low a threshold

9. In Cisco IOS syslog severity numbering, which severity level is numerically the most severe (highest priority)?

   • Emergencies (0)
   • Critical (2)
   • Warnings (4)
   • Debugging (7)

10. A remote syslog server is receiving messages from a router, but the timestamps on each message are missing or inconsistent, making it hard to correlate events with other devices. What configuration area should be adjusted?

    • The service timestamps setting for log and debug messages
    • The BGP deterministic-med setting
    • The NHRP registration interval
    • The MPLS penultimate-hop-popping behavior

11. Why would an engineer use conditional debugging (such as `debug condition`) instead of a plain global debug on a production router carrying heavy traffic?

    • It narrows debug output to a specific condition, such as an interface or IP address, greatly reducing CPU load and console/log volume compared to an unfiltered debug
    • It permanently disables all debugging on the device
    • It bypasses Control Plane Policing for debug traffic
    • It automatically converts debug output into SNMP traps

12. The local logging buffer on a router clearly shows a routing protocol flap, but the remote syslog server has no matching entry at all. Which checks should come first?

    • The remote logging configuration (`logging host` and the `logging trap` severity), plus IP reachability, source interface, and VRF toward the syslog server
    • The console logging severity set with `logging console`
    • The EIGRP feasibility condition on the flapping neighbor
    • The MPLS label stack depth

13. A router is configured with `logging buffered 4` and `logging trap 6`. A routing protocol adjacency change generates a notice-level (severity 5) message. Where will this message appear?

    • At the remote syslog destination only, because severity 5 is excluded by the local buffered threshold of 4 but included by the trap threshold of 6
    • In neither the local buffer nor the remote syslog server
    • In both the local buffer and the remote syslog server
    • Only as an SNMP trap, never as a syslog message

14. Which command displays the currently configured logging destinations, severity thresholds, and buffer utilization on a Cisco IOS device?

    • show logging
    • show snmp
    • show running-config | include syslog
    • show ip protocols

15. Which UDP port does a Cisco device use by default to send SNMP trap and inform notifications to a network management station?

    • UDP 161
    • UDP 162
    • UDP 514
    • UDP 646

16. Which UDP port does standard syslog use by default when forwarding messages to a remote collector?

    • UDP 161
    • UDP 162
    • UDP 514
    • UDP 22

17. An organization wants an SNMPv3 group that can read interface counters and system MIBs but must be blocked from reading or modifying anything under the SNMP configuration subtree itself. How should this be implemented?

    • Create a custom SNMPv3 view that excludes the SNMP configuration OID subtree, then bind that view (for read, and omit write) to the group
    • Lower the group's security level to noAuthNoPriv
    • Assign the group a community string instead of SNMPv3 credentials
    • Disable the SNMP agent process entirely for that group

18. A device sends SNMP traps for interface state changes, but the NMS never receives any of them even though SNMP polling to that device works fine. What is a likely cause specific to traps rather than polling?

    • The `snmp-server host <nms-ip> traps` (or informs) statement pointing at the NMS, or the corresponding trap-enable statements, are missing or incomplete
    • The NMS is using the wrong SNMP version to poll the device
    • SNMP polling and trap generation always share identical configuration, so this scenario is impossible
    • The device's engine ID is invalid for all SNMP operations

19. Which SNMPv3 security level provides neither authentication nor encryption, relying only on a matching username to access the agent?

    • noAuthNoPriv
    • authNoPriv
    • authPriv
    • communityOnly

20. An engineer wants to restrict which management stations are allowed to query a device over SNMP, independent of any view or security-level configuration. Which mechanism accomplishes this?

    • Applying an ACL to the SNMP community/user definition (or the `snmp-server community` / `snmp-server group` access-list clause) to restrict source addresses
    • Changing the SNMP engine ID
    • Lowering the syslog trap severity
    • Switching all users to authPriv

21. A device's local log buffer fills up and old entries begin rolling off before an engineer can review them after an outage. What is the most direct configuration change to retain more history locally?

    • Increase the buffer size with `logging buffered <size>`
    • Lower the console logging severity to emergencies only
    • Disable timestamps to save buffer space
    • Switch from a circular buffer to a linear one, which does not exist in IOS