Topic 14 Practice Test 2 covers SNMP, Syslog, and QoS for Cisco Certified Network Associate 200-301 CCNA and maps to objectives 4.4–4.5, 4.7. For broader exam preparation, review the Cisco CCNA 200-301 Exam Dumps. Every option includes focused technical reasoning explaining both the networking concept and its fit to the scenario.
Question 1
Agents are already enabled on hundreds of switches. The operations team now needs the central system that originates polls and receives device notifications. Which option should the engineer use or identify? Choose ONE.
- SNMP GET operation
- SNMP manager
- SNMP inform
- SNMP agent
Correct Answer: B
Correct Answer
Answer B is correct because SNMP manager provides centralized polling and collection from device agents. In a SNMP manager use case, it is appropriate when operations staff need centralized monitoring and queries across many devices. The observed behavior aligns with that role.
Incorrect Answers
Answer A is incorrect because SNMP GET operation concerns this behavior: SNMP GET is a manager-initiated request that. The operations evidence favors SNMP manager; SNMP GET operation operates at another control point. The SNMP manager result depends on another mechanism, not the SNMP GET operation behavior described above.
Answer C is incorrect because SNMP inform concerns this behavior: An SNMP inform is an unsolicited notification. The required SNMP manager outcome differs from the SNMP inform purpose in this operations case. For SNMP manager, choosing SNMP inform would change the control point in this operations case.
Answer D is incorrect because SNMP agent concerns this behavior: An SNMP agent runs on the managed. The operations evidence favors SNMP manager; SNMP agent operates at another control point. The SNMP manager result depends on another mechanism, not the SNMP agent behavior described above.
Question 2
A router is reachable from the NMS, but the device has no process exposing its interface counters and state to management queries. Which option should the engineer use or identify? Choose ONE.
- SNMP SET operation
- SNMPv3 with authentication and privacy
- SNMP agent
- MIB object identifier (OID)
Correct Answer: C
Correct Answer
Answer C is correct because SNMP agent provides device-side access to counters and state for a monitoring system. In a SNMP agent use case, it is appropriate when routers and switches that must answer management queries or originate notifications. The observed behavior aligns with that role.
Incorrect Answers
Answer A is incorrect because SNMP SET operation concerns this behavior: SNMP SET is a manager-initiated operation that. The required SNMP agent outcome differs from the SNMP SET operation purpose in this operations case. For SNMP agent, choosing SNMP SET operation would change the control point in this operations case.
Answer B is incorrect because SNMPv3 with authentication concerns this behavior: SNMPv3 can provide authenticated and encrypted management. Using SNMPv3 with authentication would not produce the SNMP agent behavior shown by this operations evidence. The SNMPv3 with authentication function therefore differs materially from the SNMP agent outcome required here.
Answer D is incorrect because MIB object identifier concerns this behavior: A MIB organizes managed objects, while an. In the operations case, SNMP agent differs from MIB object identifier behavior. Operationally, SNMP agent needs another behavior than MIB object identifier provides in this operations case.
Question 3
An engineer knows the NMS must query one specific interface counter rather than browse an entire device. The poll needs the unique identifier for that managed variable. Which option should the engineer use or identify? Choose ONE.
- SNMP trap
- SNMP manager
- SNMP GET operation
- MIB object identifier (OID)
Correct Answer: D
Correct Answer
Answer D is correct because MIB object identifier (OID) provides a precise identifier for one managed variable such as an interface counter. In a MIB object identifier use case, it is appropriate when Use an OID when a manager must address a particular counter or status value. The observed behavior aligns with that role.
Incorrect Answers
Answer A is incorrect because SNMP trap concerns this behavior: An SNMP trap is an unsolicited notification. Using SNMP trap would not produce the MIB object identifier behavior shown by this operations evidence. The SNMP trap function therefore differs materially from the MIB object identifier outcome required here.
Answer B is incorrect because SNMP manager concerns this behavior: An SNMP manager is the management system. The required MIB object identifier outcome differs from the SNMP manager purpose in this operations case. For MIB object identifier, choosing SNMP manager would change the control point in this operations case.
Answer C is incorrect because SNMP GET is a manager-initiated request that reads the value of a managed object from an agent For MIB object identifier, the operations evidence requires another function than SNMP GET operation.
Question 4
The monitoring server must read the current value of a read-only interface counter without changing anything on the switch. Which option should the engineer use or identify? Choose ONE.
- SNMP GET operation
- SNMP inform
- SNMP agent
- SNMP SET operation
Correct Answer: A
Correct Answer
Answer A is correct because SNMP GET operation provides a read-only poll of a device variable initiated by the NMS. In a SNMP GET operation use case, it is appropriate when Use GET for polling current state without changing device configuration. The observed behavior aligns with that role.
Incorrect Answers
Answer B is incorrect because An SNMP inform is an unsolicited notification that expects acknowledgment from the receiving manager SNMP inform misses the SNMP GET operation decision in this operations scenario. For SNMP inform, separation from SNMP GET operation remains material in this operations scenario.
Answer C is incorrect because An SNMP agent runs on the managed device and exposes local management data to an SNMP manager In the operations case, SNMP GET operation differs from SNMP agent behavior. Operationally, SNMP GET operation needs another behavior than SNMP agent provides in this operations case.
Answer D is incorrect because SNMP SET is a manager-initiated operation that writes a value to a writable managed object The operations evidence favors SNMP GET operation; SNMP SET operation operates at another control point. The SNMP GET operation result depends on another mechanism, not the SNMP SET operation behavior described above.
Question 5
A lab NMS must modify a writable managed object on a test router instead of merely reading its value. Which option should the engineer use or identify? Choose ONE.
- SNMPv3 with authentication and privacy
- SNMP SET operation
- MIB object identifier (OID)
- SNMP trap
Correct Answer: B
Correct Answer
Answer B is correct because SNMP SET operation provides a write operation from the NMS to a writable managed object. In a SNMP SET operation use case, it is appropriate when Use SET only when the management design intentionally permits remote modification of supported objects. The observed behavior aligns with that role.
Incorrect Answers
Answer A is incorrect because SNMPv3 can provide authenticated and encrypted management exchanges instead of relying only on a clear-text community string For SNMP SET operation, the operations evidence requires another function than SNMPv3 with authentication.
Answer C is incorrect because A MIB organizes managed objects, while an OID uniquely identifies a specific managed variable within that hierarchy The operations evidence favors SNMP SET operation; MIB object identifier operates at another control point.
Answer D is incorrect because An SNMP trap is an unsolicited notification from an agent to a manager and does not require an acknowledgment The required SNMP SET operation outcome differs from the SNMP trap purpose in this operations case.
Question 6
A switch should immediately notify the NMS when a power supply fails, and the design does not require the notification to be acknowledged. Which option should the engineer use or identify? Choose ONE.
- SNMP manager
- SNMP GET operation
- SNMP trap
- SNMP inform
Correct Answer: C
Correct Answer
Answer C is correct because SNMP trap provides an immediate device-originated alert with no acknowledgment requirement. In a SNMP trap use case, it is appropriate when Use traps when devices should push event information without waiting for periodic polling. The observed behavior aligns with that role.
Incorrect Answers
Answer A is incorrect because An SNMP manager is the management system that polls agents and receives notifications from managed devices SNMP manager misses the SNMP trap decision in this operations scenario. For SNMP manager, separation from SNMP trap remains material in this operations scenario.
Answer B is incorrect because SNMP GET operation is used when Use GET for polling current state without changing device configuration. Using SNMP GET operation would not produce the SNMP trap behavior shown by this operations evidence.
Answer D is incorrect because SNMP inform is used when Use informs when the sender needs confirmation that an important notification reached the manager. In the operations case, SNMP trap differs from SNMP inform behavior. Operationally, SNMP trap needs another behavior than SNMP inform provides in this operations case.
Question 7
A critical event notification must be acknowledged by the management station so the sender can detect whether delivery succeeded. Which option should the engineer use or identify? Choose ONE.
- SNMP agent
- SNMP SET operation
- SNMPv3 with authentication and privacy
- SNMP inform
Correct Answer: D
Correct Answer
Answer D is correct because SNMP inform provides an acknowledged event notification from the managed device. In a SNMP inform use case, it is appropriate when Use informs when the sender needs confirmation that an important notification reached the manager. The observed behavior aligns with that role.
Incorrect Answers
Answer A is incorrect because SNMP agent is used when routers and switches that must answer management queries or originate notifications. The operations evidence favors SNMP inform; SNMP agent operates at another control point. The SNMP inform result depends on another mechanism, not the SNMP agent behavior described above.
Answer B is incorrect because SNMP SET operation is used when Use SET only when the management design intentionally permits remote modification of supported objects. In the operations case, SNMP inform differs from SNMP SET operation behavior.
Answer C is incorrect because SNMPv3 with authentication is used when Use SNMPv3 when management traffic requires stronger identity verification and confidentiality. SNMPv3 with authentication misses the SNMP inform decision in this operations scenario. For SNMPv3 with authentication, separation from SNMP inform remains material in this operations scenario.
Question 8
Management traffic crosses an untrusted operations segment; the design requires both authenticated SNMP messages and encryption of management data. Which option should the engineer use or identify? Choose ONE.
- SNMPv3 with authentication and privacy
- MIB object identifier (OID)
- SNMP trap
- SNMP manager
Correct Answer: A
Correct Answer
Answer A is correct because SNMPv3 with authentication and privacy provides secure authenticated and encrypted SNMP monitoring over an untrusted operations segment. In a SNMPv3 with authentication use case, it is appropriate when Use SNMPv3 when management traffic requires stronger identity verification and confidentiality. The observed behavior aligns with that role.
Incorrect Answers
Answer B is incorrect because MIB object identifier is used when Use an OID when a manager must address a particular counter or status value. In the operations case, SNMPv3 with authentication differs from MIB object identifier behavior.
Answer C is incorrect because SNMP trap is used when Use traps when devices should push event information without waiting for periodic polling. SNMP trap misses the SNMPv3 with authentication decision in this operations scenario. For SNMP trap, separation from SNMPv3 with authentication remains material in this operations scenario.
Answer D is incorrect because SNMP manager is used when operations staff need centralized monitoring and queries across many devices. In the operations case, SNMPv3 with authentication differs from SNMP manager behavior. Operationally, SNMPv3 with authentication needs another behavior than SNMP manager provides in this operations case.
Question 9
A router is completely unusable and the event must be classified at the most severe syslog level. Which option should the engineer use or identify? Choose ONE.
- Syslog facility
- Syslog severity 0 (emergencies)
- logging trap severity threshold
- Syslog severity 7 (debugging)
Correct Answer: B
Correct Answer
Answer B is correct because Syslog severity 0 (emergencies) provides the highest-severity syslog classification for a system-unusable condition. In a Syslog severity 0 use case, it is appropriate when Use severity 0 for catastrophic events that indicate the device or service is effectively unavailable. The observed behavior aligns with that role.
Incorrect Answers
Answer A is incorrect because Syslog facility is used when Use facilities to classify or route messages independently from their severity. The operations evidence favors Syslog severity 0; Syslog facility operates at another control point. The Syslog severity 0 result depends on another mechanism, not the Syslog facility behavior described above.
Answer C is incorrect because logging trap severity is used when a remote collector should receive only messages at or above a chosen severity threshold. The required Syslog severity 0 outcome differs from the logging trap severity purpose in this operations case.
Answer D is incorrect because Syslog severity 7 is used when Use debugging messages during focused troubleshooting, not as the normal minimum threshold for every production destination. Using Syslog severity 7 would not produce the Syslog severity 0 behavior shown by this operations evidence.
Question 10
A TAC engineer temporarily enables the most detailed troubleshooting messages and wants the matching syslog severity classification. Which option should the engineer use or identify? Choose ONE.
- Syslog severity 0 (emergencies)
- Syslog facility
- Syslog severity 7 (debugging)
- logging trap severity threshold
Correct Answer: C
Correct Answer
Answer C is correct because Syslog severity 7 (debugging) provides the debug-level classification used for detailed troubleshooting output. In a Syslog severity 7 use case, it is appropriate when Use debugging messages during focused troubleshooting, not as the normal minimum threshold for every production destination. The observed behavior aligns with that role.
Incorrect Answers
Answer A is incorrect because Syslog severity 0 is used when Use severity 0 for catastrophic events that indicate the device or service is effectively unavailable. The required Syslog severity 7 outcome differs from the Syslog severity 0 purpose in this operations case.
Answer B is incorrect because The purpose of Syslog facility is a message-source classification that a collector can use for sorting or routing. In the operations case, Syslog severity 7 differs from Syslog facility behavior. Operationally, Syslog severity 7 needs another behavior than Syslog facility provides in this operations case.
Answer D is incorrect because The purpose of logging trap severity is a remote-syslog severity threshold for messages forwarded off the device. logging trap severity misses the Syslog severity 7 decision in this operations scenario. For logging trap severity, separation from Syslog severity 7 remains material in this operations scenario.
Question 11
A device generates debug messages locally but the remote collector should receive only informational-and-more-severe events. The engineer must control the forwarding threshold. Which option should the engineer use or identify? Choose ONE.
- Syslog severity 7 (debugging)
- Syslog severity 0 (emergencies)
- Syslog facility
- logging trap severity threshold
Correct Answer: D
Correct Answer
Answer D is correct because logging trap severity threshold provides a remote-syslog severity threshold for messages forwarded off the device. In a logging trap severity use case, it is appropriate when a remote collector should receive only messages at or above a chosen severity threshold. The observed behavior aligns with that role.
Incorrect Answers
Answer A is incorrect because The purpose of Syslog severity 7 is the debug-level classification used for detailed troubleshooting output. In the operations case, logging trap severity differs from Syslog severity 7 behavior. Operationally, logging trap severity needs another behavior than Syslog severity 7 provides in this operations case.
Answer B is incorrect because The purpose of Syslog severity 0 is the highest-severity syslog classification for a system-unusable condition. Syslog severity 0 misses the logging trap severity decision in this operations scenario. For Syslog severity 0, separation from logging trap severity remains material in this operations scenario.
Answer C is incorrect because Syslog facility concerns this behavior: A syslog facility categorizes the subsystem or. The operations evidence favors logging trap severity; Syslog facility operates at another control point. The logging trap severity result depends on another mechanism, not the Syslog facility behavior described above.
Question 12
A collector receives logs from many applications and network devices and needs the source-category value used to sort messages into the appropriate destination. Which option should the engineer use or identify? Choose ONE.
- Syslog facility
- logging trap severity threshold
- Syslog severity 7 (debugging)
- Syslog severity 0 (emergencies)
Correct Answer: A
Correct Answer
Answer A is correct because Syslog facility provides a message-source classification that a collector can use for sorting or routing. In a Syslog facility use case, it is appropriate when Use facilities to classify or route messages independently from their severity. The observed behavior aligns with that role.
Incorrect Answers
Answer B is incorrect because logging trap severity concerns this behavior: The logging trap setting controls which syslog. For Syslog facility, the operations evidence requires another function than logging trap severity. Using logging trap severity here would leave the Syslog facility requirement unresolved during this operations task.
Answer C is incorrect because Syslog severity 7 concerns this behavior: Syslog severity 7 is the least severe. The operations evidence favors Syslog facility; Syslog severity 7 operates at another control point. The Syslog facility result depends on another mechanism, not the Syslog severity 7 behavior described above.
Answer D is incorrect because Syslog severity 0 concerns this behavior: Syslog severity 0 represents the most severe. The required Syslog facility outcome differs from the Syslog severity 0 purpose in this operations case. For Syslog facility, choosing Syslog severity 0 would change the control point in this operations case.
Question 13
Before any differentiated service can be applied, the router must identify voice, business applications, and best-effort flows into separate traffic classes. Which option should the engineer use or identify? Choose ONE.
- QoS policing
- QoS classification
- Low-Latency Queue priority treatment
- QoS marking
Correct Answer: B
Correct Answer
Answer B is correct because QoS classification provides identification of a traffic class before differentiated treatment is applied. In a QoS classification use case, it is appropriate when Use classification first when policy depends on application, protocol, ACL, DSCP, or other traffic characteristics. The observed behavior aligns with that role.
Incorrect Answers
Answer A is incorrect because QoS policing concerns this behavior: Policing compares traffic with a configured rate. The operations evidence favors QoS classification; QoS policing operates at another control point. The QoS classification result depends on another mechanism, not the QoS policing behavior described above.
Answer C is incorrect because Low-Latency Queue priority concerns this behavior: A strict priority queue gives delay-sensitive traffic. The required QoS classification outcome differs from the Low-Latency Queue priority purpose in this operations case. For QoS classification, choosing Low-Latency Queue priority would change the control point in this operations case.
Answer D is incorrect because QoS marking concerns this behavior: QoS marking writes or rewrites a QoS. Using QoS marking would not produce the QoS classification behavior shown by this operations evidence. The QoS marking function therefore differs materially from the QoS classification outcome required here.
Question 14
An access switch has classified IP-phone traffic and must write a DSCP value so downstream routers can recognize the class without repeating the original classification. Which option should the engineer use or identify? Choose ONE.
- QoS shaping
- QoS trust boundary
- QoS marking
- QoS queuing and scheduling
Correct Answer: C
Correct Answer
Answer C is correct because QoS marking provides setting a QoS label such as DSCP for downstream treatment. In a QoS marking use case, it is appropriate when Use marking when traffic should carry an explicit class indication across subsequent hops. The observed behavior aligns with that role.
Incorrect Answers
Answer A is incorrect because QoS shaping concerns this behavior: Shaping buffers excess packets and schedules them. The required QoS marking outcome differs from the QoS shaping purpose in this operations case. For QoS marking, choosing QoS shaping would change the control point in this operations case.
Answer B is incorrect because QoS trust boundary concerns this behavior: A QoS trust boundary defines where existing. Using QoS trust boundary would not produce the QoS marking behavior shown by this operations evidence. The QoS trust boundary function therefore differs materially from the QoS marking outcome required here.
Answer D is incorrect because QoS queuing and concerns this behavior: Queuing and scheduling determine how packets wait. In the operations case, QoS marking differs from QoS queuing and behavior. Operationally, QoS marking needs another behavior than QoS queuing and provides in this operations case.
Question 15
During egress contention, multiple traffic classes are waiting for the same interface and need different scheduling treatment. Which option should the engineer use or identify? Choose ONE.
- QoS congestion avoidance
- QoS classification
- QoS policing
- QoS queuing and scheduling
Correct Answer: D
Correct Answer
Answer D is correct because QoS queuing and scheduling provides different service treatment among waiting traffic during egress contention. In a QoS queuing and use case, it is appropriate when Use queuing when competing traffic classes need controlled access to constrained output bandwidth. The observed behavior aligns with that role.
Incorrect Answers
Answer A is incorrect because QoS congestion avoidance concerns this behavior: Congestion avoidance mechanisms can drop selected packets. Using QoS congestion avoidance would not produce the QoS queuing and behavior shown by this operations evidence. The QoS congestion avoidance function therefore differs materially from the QoS queuing and outcome required here.
Answer B is incorrect because QoS classification concerns this behavior: QoS classification identifies packets or flows so. In the operations case, QoS queuing and differs from QoS classification behavior. Operationally, QoS queuing and needs another behavior than QoS classification provides in this operations case.
Answer C is incorrect because Policing compares traffic with a configured rate and can drop or remark traffic that exceeds the allowed profile For QoS queuing and, the operations evidence requires another function than QoS policing.
Question 16
A guest class must be capped at a committed rate, and excess packets should be dropped or remarked rather than stored for later transmission. Which option should the engineer use or identify? Choose ONE.
- QoS policing
- Low-Latency Queue priority treatment
- QoS marking
- QoS shaping
Correct Answer: A
Correct Answer
Answer A is correct because QoS policing provides hard enforcement of a traffic rate with drop or remark actions for excess packets. In a QoS policing use case, it is appropriate when Use policing when excess traffic should be enforced immediately rather than buffered to smooth the rate. The observed behavior aligns with that role.
Incorrect Answers
Answer B is incorrect because A strict priority queue gives delay-sensitive traffic preferential service during congestion, commonly used for real-time voice Low-Latency Queue priority misses the QoS policing decision in this operations scenario. For Low-Latency Queue priority, separation from QoS policing remains material in this operations scenario.
Answer C is incorrect because QoS marking writes or rewrites a QoS field such as DSCP or CoS so downstream devices can recognize the intended class For QoS policing, the operations evidence requires another function than QoS marking.
Answer D is incorrect because Shaping buffers excess packets and schedules them later so transmitted traffic conforms to a configured rate The operations evidence favors QoS policing; QoS shaping operates at another control point. The QoS policing result depends on another mechanism, not the QoS shaping behavior described above.
Question 17
A provider handoff accepts a lower rate than the LAN can burst. Excess packets should be buffered and released later to smooth the transmitted rate. Which option should the engineer use or identify? Choose ONE.
- QoS trust boundary
- QoS shaping
- QoS queuing and scheduling
- QoS congestion avoidance
Correct Answer: B
Correct Answer
Answer B is correct because QoS shaping provides rate smoothing by buffering excess traffic for later transmission. In a QoS shaping use case, it is appropriate when Use shaping when bursts should be smoothed instead of immediately discarded. The observed behavior aligns with that role.
Incorrect Answers
Answer A is incorrect because A QoS trust boundary defines where existing traffic markings are accepted versus where the network should classify or remark them For QoS shaping, the operations evidence requires another function than QoS trust boundary.
Answer C is incorrect because Queuing and scheduling determine how packets wait for and receive service when an egress interface is congested The operations evidence favors QoS shaping; QoS queuing and operates at another control point.
Answer D is incorrect because Congestion avoidance mechanisms can drop selected packets before a queue becomes completely full to reduce severe queue buildup The required QoS shaping outcome differs from the QoS congestion avoidance purpose in this operations case.
Question 18
A long TCP queue is approaching saturation. The policy should begin selectively dropping packets before the queue becomes completely full. Which option should the engineer use or identify? Choose ONE.
- QoS classification
- QoS policing
- QoS congestion avoidance
- Low-Latency Queue priority treatment
Correct Answer: C
Correct Answer
Answer C is correct because QoS congestion avoidance provides early selective packet drops intended to prevent a queue from reaching full saturation. In a QoS congestion avoidance use case, it is appropriate when Use congestion avoidance when policy should manage impending queue congestion before tail-drop occurs. The observed behavior aligns with that role.
Incorrect Answers
Answer A is incorrect because QoS classification identifies packets or flows so later policy actions can treat traffic classes differently The operations evidence favors QoS congestion avoidance; QoS classification operates at another control point. The QoS congestion avoidance result depends on another mechanism, not the QoS classification behavior described above.
Answer B is incorrect because QoS policing is used when Use policing when excess traffic should be enforced immediately rather than buffered to smooth the rate. Using QoS policing would not produce the QoS congestion avoidance behavior shown by this operations evidence.
Answer D is incorrect because Low-Latency Queue priority is used when Use priority treatment carefully for traffic that is highly sensitive to latency and jitter. In the operations case, QoS congestion avoidance differs from Low-Latency Queue priority behavior.
Question 19
Voice packets experience latency and jitter only when the WAN link is congested. The policy must give this real-time class preferential scheduling. Which option should the engineer use or identify? Choose ONE.
- QoS marking
- QoS shaping
- QoS trust boundary
- Low-Latency Queue priority treatment
Correct Answer: D
Correct Answer
Answer D is correct because Low-Latency Queue priority treatment provides preferential scheduling for delay-sensitive real-time packets during congestion. In a Low-Latency Queue priority use case, it is appropriate when Use priority treatment carefully for traffic that is highly sensitive to latency and jitter. The observed behavior aligns with that role.
Incorrect Answers
Answer A is incorrect because QoS marking is used when Use marking when traffic should carry an explicit class indication across subsequent hops. Using QoS marking would not produce the Low-Latency Queue priority behavior shown by this operations evidence.
Answer B is incorrect because QoS shaping is used when Use shaping when bursts should be smoothed instead of immediately discarded. In the operations case, Low-Latency Queue priority differs from QoS shaping behavior. Operationally, Low-Latency Queue priority needs another behavior than QoS shaping provides in this operations case.
Answer C is incorrect because QoS trust boundary is used when prevent untrusted endpoints from assigning themselves inappropriate high-priority markings. QoS trust boundary misses the Low-Latency Queue priority decision in this operations scenario. For QoS trust boundary, separation from Low-Latency Queue priority remains material in this operations scenario.
Question 20
Phones are allowed to supply trusted markings, but PCs connected through them must not be able to claim the same priority. The access layer needs a point where markings are accepted or rewritten. Which option should the engineer use or identify? Choose ONE.
- QoS trust boundary
- QoS queuing and scheduling
- QoS congestion avoidance
- QoS classification
Correct Answer: A
Correct Answer
Answer A is correct because QoS trust boundary provides the point where the network decides whether to honor an incoming QoS marking. In a QoS trust boundary use case, it is appropriate when prevent untrusted endpoints from assigning themselves inappropriate high-priority markings. The observed behavior aligns with that role.
Incorrect Answers
Answer B is incorrect because QoS queuing and is used when Use queuing when competing traffic classes need controlled access to constrained output bandwidth. In the operations case, QoS trust boundary differs from QoS queuing and behavior.
Answer C is incorrect because QoS congestion avoidance is used when Use congestion avoidance when policy should manage impending queue congestion before tail-drop occurs. QoS congestion avoidance misses the QoS trust boundary decision in this operations scenario.
Answer D is incorrect because QoS classification is used when Use classification first when policy depends on application, protocol, ACL, DSCP, or other traffic characteristics. For QoS trust boundary, the operations evidence requires another function than QoS classification.
