200-301 - IP Services - Section 4.4

Explain the function of SNMP in network operations, describe syslog features including facilities and severity levels, and explain per-hop behavior (PHB) for QoS such as classification, marking, queuing, congestion, policing, and shaping.

Explain how SNMP polls and traps expose device health to a management station and how syslog records events by facility and severity, where lower severity numbers signal more critical conditions. Describe the QoS per-hop behavior tools - classifying and marking traffic, queuing it by priority, and managing congestion with policing (drop) versus shaping (buffer) - so latency-sensitive traffic like voice is protected.

SNMPSyslog severity levelsQoS per-hop behaviorClassification and markingPolicing vs shaping

Practice question for this objective

Free sampleIP Servicesmedium

An administrator configures logging on a router with the level set to capture severity 4 and anything more serious. Which condition will NOT be recorded under this setting?

  • AAn interface line-protocol change down, logged at severity 3 (error)
  • BA power supply fault reported by the chassis at severity 2 (critical)
  • CA redundancy supervisor failover raised at severity 1 (alert)
  • DA routine configuration change notification raised at severity 5 (notification) Correct
Apply the inverted syslog severity scale where a configured level captures that number and all lower, more severe numbers. Syslog severities run 0 (emergency) to 7 (debugging), and a lower number is more severe; configuring level 4 logs severities 0 through 4 and discards 5, 6 and 7, so the severity-5 notification is suppressed.

Why A is wrong: Severity 3 is numerically lower than 4 and therefore more severe, so it is included when the threshold is set to warnings; this event is recorded, not excluded.

Why B is wrong: Severity 2 is more severe than the level-4 threshold, so critical messages are always captured; a candidate might wrongly think a lower number means lower priority.

Why C is wrong: Severity 1 sits above the warning threshold in importance, so alerts are logged; confusing the inverted scale could make this look excluded when it is not.

Why D is correct: Setting the level to 4 (warning) records severities 0 through 4 only; severity 5 is less severe than the threshold and is filtered out, so this notification is not recorded.

See more 200-301 practice questions, answers explained.

More in this domain

Back to all IP Services objectives, or the 200-301 cert hub.

Examworthy is not affiliated with or endorsed by Cisco. Original, blueprint-aligned practice material only.