Cisco Certified Network Associate (CCNA) 200-301 Practice Test 50
Question 490
A Cisco router must send syslog messages to remote collector `192.0.2.200` through a designated management interface. Which configuration approach directly establishes the remote logging path?
- Configure `logging host 192.0.2.200` with appropriate source-interface, severity and transport settings, and confirm a routed path to the collector.
- Configure only `ntp server 192.0.2.200` and expect syslog to be delivered to it.
- Configure only a local console logging level and assume a collector automatically subscribes.
- Change the VLAN native ID without defining a logging host or verifying collector reachability.
Explanation
Correct Answer
A:IOS remote syslog configuration identifies the recipient; optional source-interface and severity settings control identity and messages. Actual collector receipt still depends on IP routing, allowed transport and listener service.
Incorrect Answers
B:NTP provides clock synchronization and is not a remote syslog destination declaration.
C:Console output affects local display, not a remote log target.
D:A VLAN change cannot by itself create an IOS remote syslog destination.
Question 491
An IOS router sends syslog messages at a configured threshold of severity 4 (Warnings). An engineer expects Debugging level 7 output in the collector. What explains its absence?
- Level 7 is more urgent than level 4, so it must pass a warnings threshold.
- The router cannot generate any syslog messages unless SNMP polling succeeds.
- The configured severity filter excludes level 7 because it admits only levels 0 through 4.
- A wrong DNS AAAA record explains the filtering of already-created local debugging entries.
Explanation
Correct Answer
C:Syslog levels are ordered from Emergency 0 through Debugging 7. When the threshold is 4, higher numeric levels 5–7 are filtered; changing the facility does not invert the priority scale.
Incorrect Answers
A:The syslog numeric severity order runs in the opposite direction; 7 is the least urgent debugging class.
B:Syslog and SNMP are separate monitoring protocols; an SNMP condition does not define the syslog level filter.
D:The severity threshold, not IPv6 name resolution, is what excludes level-7 events in the stated setup.
Question 492
A collector labels router ACL-denial logs as if they were generated by the authentication subsystem. Investigation shows the collector mapped syslog facility metadata to severity names. What is the specific parsing error?
- The message could not have reached the collector because the facility label was wrong.
- Debug severity 7 and facility 7 are the same field in syslog.
- A router default route changes syslog severity when a next hop ages out.
- It conflated facility (source/subsystem) with severity (urgency), so messages were assigned to the wrong category.
Explanation
Correct Answer
D:Facility and severity are distinct parts of the syslog priority value. Parsing or mapping the facility as severity obscures the actual producing subsystem even when the log was received correctly.
Incorrect Answers
A:The case confirms receipt; the defect is classification of metadata, not packet delivery.
B:The numeric values can match coincidentally but represent different components of the message priority.
C:IP routing affects delivery, not the severity embedded in a correctly formed syslog record.
Question 493
An IOS switch records interface-down messages in its local buffer. The remote collector receives none, and the running configuration contains no `logging host` destination. Which root cause explains the missing remote entries?
- Remote syslog delivery was never configured; define the collector destination and verify source, routing and severity settings.
- A debug severity filter is blocking all local interface-down warnings.
- The messages use the wrong subsystem facility even though no remote destination exists.
- NTP clock drift prevents the switch from emitting syslog frames at all.
Explanation
Correct Answer
A:Local buffering and remote sending are distinct syslog destinations. Without a configured remote host, the switch has nowhere to send messages even though local logging works.
Incorrect Answers
B:A remote severity filter can suppress selected messages, but there is no remote logging destination at all here; local interface-down messages are present.
C:Facility labels help classification at the collector, but cannot explain absence of all traffic when no collector destination is configured.
D:Wrong timestamps complicate incident correlation but do not inherently prevent sending syslog messages to a configured remote endpoint.
Question 494
During a short controlled troubleshooting window, an operator changes the remote syslog severity threshold from Warning 4 to Debugging 7 specifically to capture a level-7 event. Which observation proves the new filter passes the intended event?
- The collector receives only level-4 warnings and no deliberately generated level-7 event.
- The router's local clock is synchronized but no remote debug event is checked.
- The collector reports a facility label but discards the message before recording its severity.
- The remote collector receives the expected event with its actual facility and severity 7 intact, and the router's configured threshold permits levels 0–7.
Explanation
Correct Answer
D:A severity-7 threshold admits standard syslog levels 0 through 7, including Debugging. Verifying the real received level and source facility establishes both filter behavior and correct remote classification; restore an appropriate production threshold afterward.
Incorrect Answers
A:Warnings were already admitted before the change and cannot demonstrate the requested Debugging acceptance.
B:Time accuracy is useful for correlation but does not validate logging severity filtering or transport.
C:That does not prove the level-7 filter or correct severity parsing is operational.
Question 495
Hosts in VLAN 30 broadcast DHCPDISCOVER to 255.255.255.255. Their DHCP server is at 10.1.1.25 on a different routed network. The VLAN 30 SVI is 10.30.0.1/24 and the uplink routing is healthy. Which IOS interface command forwards client DHCP requests to that remote server?
- Configure `ip nat inside source static 10.30.0.1 10.1.1.25` on the gateway.
- Configure `ip helper-address 10.1.1.25` on the VLAN 30 routed gateway interface/SVI.
- Configure `switchport trunk allowed vlan 30` on each client access interface.
- Configure `ntp server 10.1.1.25` to authorize the DHCP server's lease updates.
Explanation
Correct Answer
B:DHCP clients initially broadcast because they do not yet have an assigned address or server location. Routers generally do not forward that local broadcast across subnets as ordinary IP traffic. The Cisco `ip helper-address` feature on the receiving VLAN 30 Layer 3 interface can relay the relevant request to the remote DHCP server. The relay provides gateway information such as the giaddr field so the server can choose the appropriate address scope for 10.30.0.0/24. Verify relay configuration, server reachability, returned Offer/Ack traffic, and the client's lease, mask, gateway and DNS options. The helper belongs on the client-facing routed interface, not an arbitrary host access port.
Incorrect Answers
A:Static NAT creates an address translation between internal and external addressing contexts; it does not relay a DHCPDISCOVER broadcast and does not select the client's DHCP scope. Translating the VLAN gateway address to the server IP would change unrelated traffic behavior. Use DHCP relay semantics rather than NAT to cross the router boundary.
C:A trunk allowed-VLAN list controls which tagged Layer 2 VLAN traffic can cross an interswitch trunk. A normal client access port does not need to be a trunk, and permitting VLAN 30 locally does not route broadcasts to a server on another IP network. The SVI's DHCP relay function is the missing piece.
D:NTP provides time synchronization for network devices; a DHCP server does not become an address relay target because its IP appears in an NTP peer statement. This command would affect clock synchronization attempts, not forwarding initial DHCP client broadcasts to a remote scope.
Question 496
A router's Ethernet WAN-facing interface must acquire its own IPv4 address, mask and optional default gateway information from a reachable DHCP service instead of a fixed interface address. What IOS interface configuration supports that role?
- Configure the routed interface with `ip address dhcp`, keep it operationally up and inspect the resulting lease/state.
- Configure only `ip helper-address` on the interface and assume the router obtains its own address.
- Configure a static 192.0.2.1/24 address and claim it was dynamically leased.
- Administratively shut down the interface while expecting DHCP exchange to complete normally.
Explanation
Correct Answer
A:In IOS, `ip address dhcp` makes the routed interface a DHCP client for its own IPv4 parameters. This differs from `ip helper-address`, which relays other hosts' DHCP broadcasts.
Incorrect Answers
B:DHCP relay forwards requests for other clients; it is not the routed interface's own DHCP-client address command.
C:A manually fixed interface IP does not meet the DHCP-client requirement.
D:A down routed interface cannot successfully transmit the client DHCP exchange on its link.
Question 497
VLAN 30 clients should receive DHCP addresses from `10.30.0.0/24`, default gateway `10.30.0.1` and DNS server `10.1.1.53`. Which server scope settings are correct?
- Use a 10.31.0.0/24 scope while keeping the VLAN 30 gateway at 10.30.0.1.
- Set option 3 to 10.1.1.53 and option 6 to 10.30.0.1.
- Use a 10.30.0.0/24 address pool with mask 255.255.255.0, default-router option 3 set to 10.30.0.1 and DNS option 6 set to 10.1.1.53.
- Supply only an address without a subnet mask or gateway even though routed connectivity is required.
Explanation
Correct Answer
C:The DHCP server must supply an address in the client subnet and options consistent with its routed SVI. A relay agent can deliver remote requests, but a correct relay does not fix wrong scope data.
Incorrect Answers
A:The offered lease would not be on the correct client LAN and would fail normal on-link gateway use.
B:Those values swap the DNS and gateway roles and would send clients to incorrect services.
D:Incomplete/incorrect options can prevent clients from reaching off-subnet services despite successful DHCP allocation.
Question 498
Clients in VLAN 50 cannot obtain addresses from a remote DHCP server, although a DHCP client in the server's local VLAN works. The client SVI has no `ip helper-address`, and routers do not have a directed-broadcast forwarding design. Which fault best explains why no DHCPOFFER returns?
- The switch has a lower Spanning Tree bridge ID than the DHCP server.
- A stale DNS AAAA record for the server is preventing all IPv4 DHCPDISCOVER packets.
- The local DHCPDISCOVER broadcast is not being relayed from VLAN 50 to the remote server subnet.
- The router must enable NAT overload before any private-address DHCP lease can be granted.
Explanation
Correct Answer
C:A client without a usable IPv4 address typically begins DHCP with a local broadcast DISCOVER. Routers do not forward ordinary local broadcasts, so a remote server will not receive them unless the gateway relays the request or an equivalent supported design exists. The missing `ip helper-address` on VLAN 50's Layer 3 gateway is the key observation, especially because the server works for clients on its own local network. Configure a helper to the correct server, ensure the server offers a pool for the giaddr subnet, and verify DISCOVER/OFFER/REQUEST/ACK exchange. Also check ACLs and paths if relay is present but offers still fail.
Incorrect Answers
A:Spanning Tree selects forwarding topology for Layer 2 switched segments using bridge identifiers and path cost. A low bridge ID may affect root election but does not inherently explain why DHCP works locally at the server yet fails for a client behind a routed SVI with no relay. The missing relay is decisive.
B:DHCPDISCOVER is a broadcast IPv4 address-provisioning message and does not require clients to resolve a DNS AAAA hostname. DNS record staleness may affect applications after the client receives an address. It cannot directly prevent an unconfigured client from broadcasting a request on its local VLAN.
D:NAT overload allows multiple inside hosts to share outside addressing for routed connections. A DHCP server can lease RFC 1918 addresses without NAT, and clients need not access the Internet to receive initial configuration. The issue is transport of DHCP broadcasts across the gateway, not translation of client application traffic.
Question 499
After a maintenance window, Gi0/1 shows `administratively down, line protocol down`. The interface still has `ip address dhcp` in its running configuration but holds no lease. What should be restored before investigating DHCP server scope?
- Change DHCP option 3 to a new remote gateway for an interface that has no active link.
- Bring Gi0/1 administratively up with `no shutdown` and verify link protocol and DHCP renewal.
- Enable a DHCP relay helper on an unrelated client-facing SVI.
- Delete the DHCP client command because it is already present.
Explanation
Correct Answer
B:A shutdown interface cannot exchange DHCP discovery or offer messages. Bring the interface up and confirm operational carrier before testing DHCP connectivity.
Incorrect Answers
A:Gateway options arrive only in a lease; with an administratively disabled interface there is no DHCP exchange to deliver an option.
C:A relay could matter if broadcast clients were separated from a server, but this interface is directly configured as a DHCP client and is shutdown.
D:Deleting the already present `ip address dhcp` would remove the client behavior needed after the interface is brought up.
Question 500
A Windows client leases a correct `10.30.0.0/24` address, but its DHCP-provided option 3 points to obsolete gateway `10.30.0.254` rather than the current SVI `10.30.0.1`. On-LAN peers work; off-LAN IP literals do not. Which defect explains this?
- The DHCP pool address prefix is necessarily wrong because the host leased an address inside the expected /24.
- DNS alone is causing failure to reach a numerical remote IPv4 address.
- DHCP is delivering an incorrect default-router (option 3) value even though the lease address itself is in the right subnet.
- A valid DHCPOFFER guarantees that all later gateway options are correct.
Explanation
Correct Answer
C:Option 3 supplies the client's default gateway. Local traffic can be ARPed directly on the /24, but off-subnet forwarding uses that incorrect next hop; correct the server scope option and renew affected leases.
Incorrect Answers
A:The address portion is correct by evidence; the reported fault lies in gateway option 3.
B:DNS is bypassed when testing IP literals, and the wrong default gateway directly explains the routed failure.
D:A lease can complete while carrying an obsolete or wrong router option.