200-301 - IP Services (10% of the exam) - Section 4.4
Explain the function of SNMP in network operations, describe syslog features including facilities and severity levels, and explain per-hop behavior (PHB) for QoS such as classification, marking, queuing, congestion, policing, and shaping.
Explain how SNMP polls and traps expose device health to a management station and how syslog records events by facility and severity, where lower severity numbers signal more critical conditions. Describe the QoS per-hop behavior tools - classifying and marking traffic, queuing it by priority, and managing congestion with policing (drop) versus shaping (buffer) - so latency-sensitive traffic like voice is protected.
SNMPSyslog severity levelsQoS per-hop behaviorClassification and markingPolicing vs shaping
Practice question for this objective
lock_openFree sampleIP Servicesmedium
An administrator configures logging on a router with the level set to capture severity 4 and anything more serious. Which condition will NOT be recorded under this setting?
AAn interface line-protocol change down, logged at severity 3 (error)
BA power supply fault reported by the chassis at severity 2 (critical)
CA redundancy supervisor failover raised at severity 1 (alert)
DA routine configuration change notification raised at severity 5 (notification)check_circle Correct
Apply the inverted syslog severity scale where a configured level captures that number and all lower, more severe numbers. Syslog severities run 0 (emergency) to 7 (debugging), and a lower number is more severe; configuring level 4 logs severities 0 through 4 and discards 5, 6 and 7, so the severity-5 notification is suppressed.
Why A is wrong: Severity 3 is numerically lower than 4 and therefore more severe, so it is included when the threshold is set to warnings; this event is recorded, not excluded.
Why B is wrong: Severity 2 is more severe than the level-4 threshold, so critical messages are always captured; a candidate might wrongly think a lower number means lower priority.
Why C is wrong: Severity 1 sits above the warning threshold in importance, so alerts are logged; confusing the inverted scale could make this look excluded when it is not.
Why D is correct: Setting the level to 4 (warning) records severities 0 through 4 only; severity 5 is less severe than the threshold and is filtered out, so this notification is not recorded.
Answers that look right on this material and are not. Each one is a distractor from a different question in the 200-301 bank for this domain.
An SNMP trap, because the agent retransmits it on a fixed timer until the event clears
errorWhy it is wrong: Traps are unacknowledged notifications sent over UDP and the agent never learns whether the manager received them; there is no delivery confirmation, so this fails the requirement.
Traffic policing, because it queues conforming and exceeding packets and meters them out at the configured rate
errorWhy it is wrong: Policing does not buffer; it meters traffic and drops or remarks anything above the rate, which is the discarding behaviour the team is trying to avoid.
Severity 4 through 7 only, that is warnings, notifications, informational and debugging
errorWhy it is wrong: This inverts the scale; syslog forwards the chosen level and all lower NUMBERS, not all higher numbers, so warnings sends 0 to 4, not 4 to 7.