Exam 350-401 topic 1 question 715 discussion

This question applies to Catalyst 3850 SWITCH. Answer is BD not BC. logging host 203.0.113.11 vrf Mgmt-vrf transport tcp - changed from udp to tcp logging trap notifications - change from informational to notification/notice logging source-Interface GigabitEthernet0/0 vrf Mgmt-vrf - will be used by default. Gig0/0 will most probably be the only interface on the switch in VRF mgmt hence no need to configure this one.

B and D are correct

transport reliable, so option B for sure (TCP) and option D (not A of course) as by default the loglevel is informational

# Configure logging to the syslog server with VRF logging 192.168.1.1 vrf mngt # Set logging severity level (e.g., informational) logging trap informational

By default, syslog servers receive informational messages (level 6)

When the IP SLA operation is scheduled, it can be verified with the show ip sla configuration command. Example 24-55 illustrates the configuration steps to schedule the IP SLA 1 operation with a start time of now and a lifetime of forever. This example also shows the verification that it is running and configured properly. OCG

Has to be B and C because [D] is not needed, as default logging trap level is notifications. Command Default Syslog messages at level 0 to level 6 are generated, but will only be sent to a remote host if the logging host command is configured. [0 | emergencies]—System is unusable [1 | alerts]—Immediate action needed [2 | critical]—Critical conditions [3 | errors]—Error conditions [4 | warnings]—Warning conditions [5 | notifications]—Normal but significant conditions [6 | informational]—Informational messages [7 | debugging]—Debugging messages

B: there we configure the syslog and specify the vrf and the protocol to be tcp. D: The requirement is for the lowest severity to be Notification. Regarding the requirement that the syslog needs to be reachable through interface G0/0. The interface is already part of the VRF and there is a default route pointing to the subnet of the interface. The server needs to be reachable "through that interface" not "only through that interface"

it says "initial message severity: notifications" the default is informational so we have to choose D. B is clear

This question applies to Catalyst 3850 SWITCH. logging host 203.0.113.11 vrf Mgmt-vrf transport tcp - changed from udp to tcp logging trap notifications - change from informational to notification/notice logging source-Interface GigabitEthernet0/0 vrf Mgmt-vrf - will be used by default. Gig0/0 will most probably be the only interface on the switch in VRF mgmt hence no need to configure this one.

Configuring VRF Aware System Message Logging on a Routing Device Perform this task to configure the VRF Aware System Message Logging feature on a routing device. This allows the sending of logging messages that can be used to monitor and troubleshoot network traffic connected through VRF instances. Prerequisites You must perform the following tasks before you perform this task: •Configuring a VRF on a Routing Device •Associating a VRF with an Interface SUMMARY STEPS 1. enable 2. configure terminal 3. logging host {ip-address | hostname} [vrf vrf-name] 4. logging trap level 5. logging facility facility-type 6. logging buffered [buffer-size | severity-level] 7. end

I have to agree with other users. I tried different scenarios, one where the router is directly connected to the Syslog server, and one where the router was two hops away from the server. If you don't specify the source interface, it will utilize the one for egress traffic towards the default route.

Answer BC The default trap level (Trap being what goes to syslog server) is informational, so answer D is not necessary. Answer A doesn't affect what goes to the syslog server, only what goes to terminal sessions (Telnet/SSH) So that leaves two of B, C and E. You need to specify TCP as the transport, so you need B, and that crosses out E since E is same as B but without TCP So all you have left to go with B is C to specify the source interface. Someone on Cisco community asked a similar question with regards to sending sylog through the the management interface: https://community.cisco.com/t5/network-management/logging-through-the-management-interface/td-p/3071828 Reply said to specify the VRF when specifying the source interface. The OP then replied he also had to specify the VRF when specifying the host.

the question is asking us to ensure that send packets through G0/0. The only way to do that is to use the logging source-interface command

I'd say B and D, but how can an expert come to "BE"?

If it's sa hard to get it right here... how to do in the actual exam?

Answers are 100% A and E i am backing up my information here For Answer A: https://www.cisco.com/c/en/us/td/docs/routers/access/wireless/software/guide/SysMsgLogging.html For Answer E: https://www.cisco.com/c/en/us/td/docs/ios/12_2sr/12_2sra/feature/guide/srvrfslg.html You're welcome