Cisco CCNP 350-401 ENCOR Diagnostics, Debugs, Ping/Traceroute, SNMP, and Syslog Practice Test 1

 

Topic 13 Practice Test 1 covers Diagnostics, Debugs, Ping/Traceroute, SNMP, and Syslog for Cisco 350-401 ENCOR. For broader exam preparation, review the Cisco 350-401 ENCOR Exam Dumps. Every option includes focused technical reasoning explaining both the Cisco enterprise networking concept and its fit to the scenario.

Question 1

A distribution router can ping a server when probes use its WAN interface address, but an application sourced from Loopback0 still fails. The engineer must determine whether the return path to Loopback0 is valid without changing routing. Which diagnostic action is best? Choose ONE.

1. Traceroute with the default source
2. Enable unrestricted IP debugging
3. Extended ping sourced from Loopback0
4. Standard ping using the default source

Correct Answer(s)

 

C

Rationale

1. Traceroute with the default source serves another purpose because it can reveal hops yet still may use the WAN address, so it does not isolate whether Loopback0 itself has a usable return path. The scenario instead asks how to test the return path specifically for traffic sourced from Loopback0 while leaving routing unchanged, so it cannot provide the needed result.
2. Enable unrestricted IP debugging creates broad control-plane output and operational load without first reproducing the source-specific forwarding symptom, while the case requires the team to test the return path specifically for traffic sourced from Loopback0 while leaving routing unchanged. Those mechanisms address different conditions, making this a distractor.
3. Extended ping sourced from Loopback0 sends the probe with the same source identity used by the failing application, directly testing return-path reachability to Loopback0. That directly meets the need to test the return path specifically for traffic sourced from Loopback0 while leaving routing unchanged, so it is the most targeted diagnostic choice.
4. Do not choose Standard ping using the default source. It tests generic reachability but may select the WAN interface as the source and therefore does not reproduce the failing source identity. The current task is to test the return path specifically for traffic sourced from Loopback0 while leaving routing unchanged, which this option does not test or control.

 

Question 2

An IOS XE ping to a remote address returns a sequence containing several `U` characters instead of `!`. What does the `U` result indicate? Choose ONE.

1. The echo reply arrived successfully
2. The probe timed out without any response
3. ICMP destination-unreachable message received
4. The device detected a routing loop

Correct Answer(s)

 

C

Rationale

1. The role of The echo reply arrived successfully is that it is represented by an exclamation mark in Cisco ping output, not the `U` character shown in the evidence. That does not satisfy the need to interpret a Cisco ping result that contains U responses rather than successful exclamation marks, leaving the decisive condition untested.
2. Reject The probe timed out without any response here. It is normally represented by a period, whereas `U` reflects an explicit unreachable message returned to the sender; the engineer instead needs to interpret a Cisco ping result that contains U responses rather than successful exclamation marks. The two actions answer different operational questions.
3. Use ICMP destination-unreachable message received, which matches Cisco ping result notation in which `U` reports that a device returned an ICMP destination-unreachable message for the probe. That behavior supports the need to interpret a Cisco ping result that contains U responses rather than successful exclamation marks and produces the relevant evidence or control.
4. The device detected a routing loop does not match the evidence because it cannot be concluded from a `U` ping code alone; a routing loop is usually localized with path evidence such as traceroute. The requirement is to interpret a Cisco ping result that contains U responses rather than successful exclamation marks, so the option works on another function.

 

Question 3

A traceroute from a campus edge repeatedly alternates between the same two router addresses until the maximum hop count is reached. Which fault does this evidence most strongly suggest? Choose ONE.

1. A routing loop between the two routers
2. SNMP polling is disabled
3. A single downstream ACL silently drops the probes
4. The destination host is powered off

Correct Answer(s)

 

A

Rationale

1. A routing loop between the two routers is the direct fit because it explains why successive TTL-expired probes revisit the same pair of Layer 3 devices instead of progressing toward the destination. Here the engineer must interpret an alternating two-hop traceroute pattern that persists until the hop limit is exhausted, so the mechanism matches the required layer.
2. SNMP polling is disabled is insufficient here. It affects management visibility and has no mechanism that would create a repeated forwarding path in traceroute output, but the engineer must interpret an alternating two-hop traceroute pattern that persists until the hop limit is exhausted. The needed evidence depends on a different behavior.
3. A single downstream ACL silently drops the probes addresses another management need because it would more commonly cause missing replies or asterisks beyond a point, not repeated alternation between the same two hop addresses. The case requires the team to interpret an alternating two-hop traceroute pattern that persists until the hop limit is exhausted, so it cannot resolve this symptom.
4. The scenario does not call for The destination host is powered off. It can prevent completion of a trace but does not by itself make intermediate TTL-expired responses bounce between two routers, whereas the objective is to interpret an alternating two-hop traceroute pattern that persists until the hop limit is exhausted. That difference makes the option unsuitable.

 

Question 4

A traceroute displays an asterisk for one probe at hop 6, while the other probes at that hop and later hops return normally. Which interpretation is most accurate? Choose ONE.

1. The destination returned an ICMP echo reply
2. That probe timed out
3. The router changed its SNMP community string
4. Hop 6 is definitely down

Correct Answer(s)

 

B

Rationale

1. The function of The destination returned an ICMP echo reply is to does not correspond to the asterisk; the asterisk specifically represents the absence of a timely response for that probe. In this case the team must instead interpret an isolated traceroute asterisk when other probes and later hops still respond, so the feature targets another concern.
2. The correct choice is That probe timed out. It matches traceroute behavior: an asterisk is printed when the timer expires before a response is received, and later successful hops show forwarding can continue, matching the requirement to interpret an isolated traceroute asterisk when other probes and later hops still respond without changing an unrelated function.
3. The router changed its SNMP community string fails the scenario fit even though it could break SNMP polling but would not explain a single missing traceroute response amid otherwise successful path replies. The decisive requirement is to interpret an isolated traceroute asterisk when other probes and later hops still respond, which this choice does not meet.
4. Hop 6 is definitely down is an adjacent feature. It is too strong because the same hop answered other probes and later hops responded, so reachability through that point still exists, while the maintenance task is to interpret an isolated traceroute asterisk when other probes and later hops still respond. That purpose mismatch prevents a direct answer.

 

Question 5

Small pings succeed across a WAN path, but a tunneled application fails when larger packets have the DF bit set. The team wants to test for a path-MTU problem without changing the application. What should it do? Choose ONE.

1. Increase the syslog severity threshold
2. Run a normal ping using the default small payload
3. Enable SNMP informs on every router
4. Extended ping with DF set and varied payload sizes

Correct Answer(s)

 

D

Rationale

1. Increase the syslog severity threshold can help in other incidents because it changes which messages are logged and does not test packet size, fragmentation behavior, or end-to-end forwarding across the WAN. It is not equivalent where the engineer needs to validate a suspected path-MTU black hole when small probes pass but larger DF-set traffic fails.
2. This distractor is valid elsewhere: Run a normal ping using the default small payload repeats a test that is already known to succeed and does not exercise the packet size that triggers the application failure. The requirement here is to validate a suspected path-MTU black hole when small probes pass but larger DF-set traffic fails, so it does not act on the same condition.
3. Enable SNMP informs on every router should be ruled out because it improves notification reliability but does not generate controlled DF-set probes needed to characterize the MTU limit. The troubleshooting goal is to validate a suspected path-MTU black hole when small probes pass but larger DF-set traffic fails, and this feature answers a different question.
4. The scenario points to Extended ping with DF set and varied payload sizes: it lets the engineer probe progressively sized packets while forbidding fragmentation, which directly reveals the largest size that can traverse the path intact. The decisive requirement is to validate a suspected path-MTU black hole when small probes pass but larger DF-set traffic fails, which this option directly addresses.

 

Question 6

Why can traceroute identify successive Layer 3 hops along a path? Choose ONE.

1. Increasing-TTL probes elicit ICMP Time Exceeded replies
2. It sends only ICMP echo requests with a constant TTL
3. It reads each router’s SNMP neighbor table in sequence
4. It relies on syslog servers to forward hop addresses

Correct Answer(s)

 

A

Rationale

1. Increasing-TTL probes elicit ICMP Time Exceeded replies describes the mechanism that causes each successive router to expire a probe and identify itself as the TTL is incremented. That directly meets the need to explain the control-plane mechanism traceroute uses to expose successive routing hops, so it is the most targeted diagnostic choice.
2. It sends only ICMP echo requests with a constant TTL is not supported by the stated constraint. It would not deliberately expire probes at successive routers, so it could not reveal the ordered hop-by-hop path. The case requires the engineer to explain the control-plane mechanism traceroute uses to expose successive routing hops, so it misses the symptom.
3. It reads each router’s SNMP neighbor table in sequence solves another problem because it would require management access to every device and is not how ordinary traceroute learns the path from transit routers. The current case depends on the need to explain the control-plane mechanism traceroute uses to expose successive routing hops, which requires a different mechanism.
4. Using It relies on syslog servers to forward hop addresses would not close the investigation. It syslog transports event messages and is not involved in the TTL-expiration exchange used by traceroute, while the team still needs to explain the control-plane mechanism traceroute uses to expose successive routing hops. Those tasks are not equivalent.

 

Question 7

Enabling a broad debug on a busy core switch produces excessive output. Only traffic associated with one affected flow needs to be observed. What is the best next step? Choose ONE.

1. Replace the debug with periodic SNMP polling only
2. Disable all logging destinations
3. Apply a conditional debug that matches the affected flow
4. Raise console logging to debugging for all messages

Correct Answer(s)

 

C

Rationale

1. Replace the debug with periodic SNMP polling only serves another purpose because it can expose counters or state but cannot provide the packet- or event-level debug evidence the engineer specifically needs. The scenario instead asks how to collect debug evidence for one affected flow on a busy device without continuing broad unrestricted debugging, so it cannot provide the needed result.
2. Disable all logging destinations removes visibility rather than narrowing the diagnostic scope, making it harder to capture the flow-specific condition, while the case requires the team to collect debug evidence for one affected flow on a busy device without continuing broad unrestricted debugging. Those mechanisms address different conditions, making this a distractor.
3. Use Apply a conditional debug that matches the affected flow, which reduces debug processing and output to the relevant condition, preserving useful evidence while avoiding the noise of an unrestricted debug. That behavior supports the need to collect debug evidence for one affected flow on a busy device without continuing broad unrestricted debugging and produces the relevant evidence or control.
4. Do not choose Raise console logging to debugging for all messages. It increases displayed message volume and does not constrain the debug to the traffic that matters for the incident. The current task is to collect debug evidence for one affected flow on a busy device without continuing broad unrestricted debugging, which this option does not test or control.

 

Question 8

An engineer starts a debug from an SSH session. The debug is active, but no messages appear in that VTY session even though the event is occurring. Which command should be used for that session? Choose ONE.

1. terminal length 0
2. terminal monitor
3. logging buffered
4. snmp-server enable traps

Correct Answer(s)

 

B

Rationale

1. The role of terminal length 0 is that it changes pagination behavior for command output but does not subscribe the VTY to debug and system-message output. That does not satisfy the need to display active debug output in the engineer’s current SSH VTY session, leaving the decisive condition untested.
2. terminal monitor is the direct fit because it directs system logging and debug output to the current virtual terminal so the SSH user can see messages generated during the test. Here the engineer must display active debug output in the engineer’s current SSH VTY session, so the mechanism matches the required layer.
3. Reject logging buffered here. It stores messages in the device’s local logging buffer; it does not by itself display them live in the current VTY session; the engineer instead needs to display active debug output in the engineer’s current SSH VTY session. The two actions answer different operational questions.
4. snmp-server enable traps does not match the evidence because it enables selected SNMP notifications to a management station and does not make the SSH terminal receive debug output. The requirement is to display active debug output in the engineer’s current SSH VTY session, so the option works on another function.

 

Question 9

A short troubleshooting debug has captured the required evidence. The engineer must stop all active debugging immediately before leaving the maintenance window. Which command is most appropriate? Choose ONE.

1. no logging console
2. terminal monitor
3. clear logging
4. undebug all

Correct Answer(s)

 

D

Rationale

1. no logging console is insufficient here. It stops console delivery of messages but does not disable the debug features generating those messages, but the engineer must stop every active debug promptly after the required evidence has been captured. The needed evidence depends on a different behavior.
2. terminal monitor addresses another management need because it controls whether a VTY displays messages; it does not deactivate the underlying debug processes on the device. The case requires the team to stop every active debug promptly after the required evidence has been captured, so it cannot resolve this symptom.
3. The scenario does not call for clear logging. It clears entries from the local logging buffer but leaves active debug commands running and consuming resources, whereas the objective is to stop every active debug promptly after the required evidence has been captured. That difference makes the option unsuitable.
4. The correct choice is undebug all. It disables active debug functions in one action and is the standard way to stop the potentially expensive diagnostic processing once evidence collection is complete, matching the requirement to stop every active debug promptly after the required evidence has been captured without changing an unrelated function.

 

Question 10

A network engineer wants to confirm the currently configured logging destinations, severity settings, and contents of the local logging buffer before changing anything. Which command provides the most direct verification? Choose ONE.

1. show ip route
2. show logging
3. traceroute
4. show snmp

Correct Answer(s)

 

B

Rationale

1. The function of show ip route is to verifies Layer 3 routing state rather than message logging behavior, so it cannot validate logging destinations or buffer contents. In this case the team must instead inspect existing IOS XE logging configuration state and buffered messages before making a change, so the feature targets another concern.
2. The scenario points to show logging: it displays the device logging state and buffer, allowing the engineer to verify where messages are sent and what severity behavior is currently in effect. The decisive requirement is to inspect existing IOS XE logging configuration state and buffered messages before making a change, which this option directly addresses.
3. traceroute fails the scenario fit even though it tests a forwarding path and does not reveal how IOS XE is configured to store or export system messages. The decisive requirement is to inspect existing IOS XE logging configuration state and buffered messages before making a change, which this choice does not meet.
4. show snmp is an adjacent feature. It reports SNMP subsystem information and does not provide the full syslog destination, severity, and local-buffer view required here, while the maintenance task is to inspect existing IOS XE logging configuration state and buffered messages before making a change. That purpose mismatch prevents a direct answer.

 

Question 11

A remote syslog server should receive emergencies, alerts, critical, errors, and warnings, but not notifications or informational/debugging messages. Which IOS XE setting fits the requirement? Choose ONE.

1. logging trap warnings
2. logging trap debugging
3. logging console warnings
4. logging buffered warnings

Correct Answer(s)

 

A

Rationale

7. logging trap warnings sets the remote syslog threshold at severity 4, which includes numerically lower and more severe levels 0 through 4 while excluding levels 5 through 7. That directly meets the need to send remote syslog messages through severity warning while excluding notification, informational, and debugging levels, so it is the most targeted diagnostic choice.
8. logging trap debugging can help in other incidents because it permits severity 7 and therefore includes all severity levels, sending substantially more messages than the requirement allows. It is not equivalent where the engineer needs to send remote syslog messages through severity warning while excluding notification, informational, and debugging levels.
9. This distractor is valid elsewhere: logging console warnings applies the warning threshold to console output instead of controlling which messages are exported to the remote syslog server. The requirement here is to send remote syslog messages through severity warning while excluding notification, informational, and debugging levels, so it does not act on the same condition.
10. logging buffered warnings should be ruled out because it limits the local memory buffer and does not set the severity threshold used for remote syslog transmission. The troubleshooting goal is to send remote syslog messages through severity warning while excluding notification, informational, and debugging levels, and this feature answers a different question.

 

Question 12

Events from several devices must be correlated to the millisecond during a short routing outage. Which configuration most directly improves the precision of timestamps attached to log messages? Choose ONE.

1. snmp-server host
2. logging trap informational
3. service timestamps log datetime msec
4. terminal monitor

Correct Answer(s)

 

C

Rationale

1. snmp-server host is not supported by the stated constraint. It defines an SNMP notification receiver and has no role in formatting timestamps on IOS XE syslog records. The case requires the engineer to add millisecond-resolution date and time to syslog messages for cross-device event correlation, so it misses the symptom.
2. logging trap informational solves another problem because it changes the remote severity threshold but does not add or increase the precision of timestamps in individual messages. The current case depends on the need to add millisecond-resolution date and time to syslog messages for cross-device event correlation, which requires a different mechanism.
3. Use service timestamps log datetime msec, which adds date-and-time timestamps with millisecond granularity to system log messages, providing the ordering precision needed for cross-device incident correlation. That behavior supports the need to add millisecond-resolution date and time to syslog messages for cross-device event correlation and produces the relevant evidence or control.
4. Using terminal monitor would not close the investigation. It displays logging output on a VTY session but does not determine the timestamp format or millisecond precision of generated messages, while the team still needs to add millisecond-resolution date and time to syslog messages for cross-device event correlation. Those tasks are not equivalent.

 

Question 13

A switch currently records messages locally, but operations needs those messages sent to the collector at 192.0.2.40. Which configuration element establishes that remote syslog destination? Choose ONE.

1. logging synchronous
2. logging host 192.0.2.40
3. snmp-server community 192.0.2.40
4. logging buffered

Correct Answer(s)

 

B

Rationale

192. logging synchronous serves another purpose because it improves CLI usability by redisplaying prompts around asynchronous messages, but it does not configure a remote syslog target. The scenario instead asks how to configure 192.0.2.40 as the remote syslog collector for device messages, so it cannot provide the needed result.
193. logging host 192.0.2.40 is the direct fit because it identifies the remote logging server so IOS XE can export qualifying system messages to that collector according to the configured severity and transport behavior. Here the engineer must configure 192.0.2.40 as the remote syslog collector for device messages, so the mechanism matches the required layer.
194. snmp-server community 192.0.2.40 does not configure a syslog destination and also misuses an SNMP community command for an unrelated management protocol, while the case requires the team to configure 192.0.2.40 as the remote syslog collector for device messages. Those mechanisms address different conditions, making this a distractor.
195. Do not choose logging buffered. It enables or sizes local in-memory message storage and does not identify the external collector that should receive logs. The current task is to configure 192.0.2.40 as the remote syslog collector for device messages, which this option does not test or control.

 

Question 14

A remote collector permits syslog only from the router’s Loopback0 address. Interface failover causes the default syslog source address to change. What should be configured? Choose ONE.

1. service timestamps log uptime
2. logging console critical
3. snmp-server trap-source Loopback0
4. logging source-interface Loopback0

Correct Answer(s)

 

D

Rationale

1. The role of service timestamps log uptime is that it changes how log records are timestamped and does not control the IP source address used to reach the collector. That does not satisfy the need to keep the router’s syslog source address fixed at Loopback0 despite egress-interface changes, leaving the decisive condition untested.
2. Reject logging console critical here. It filters console messages by severity and has no effect on the source address of remote syslog packets; the engineer instead needs to keep the router’s syslog source address fixed at Loopback0 despite egress-interface changes. The two actions answer different operational questions.
3. snmp-server trap-source Loopback0 does not match the evidence because it sets the source interface for SNMP notifications, not for syslog traffic sent to the logging collector. The requirement is to keep the router’s syslog source address fixed at Loopback0 despite egress-interface changes, so the option works on another function.
4. The correct choice is logging source-interface Loopback0. It forces syslog packets to use the stable Loopback0 source identity, allowing the collector ACL to continue matching even when the forwarding egress interface changes, matching the requirement to keep the router’s syslog source address fixed at Loopback0 despite egress-interface changes without changing an unrelated function.

 

Question 15

The management network is not trusted. Policy requires SNMP polling to authenticate the manager/user and encrypt the management payload. Which SNMPv3 security level is required? Choose ONE.

1. authPriv (priv)
2. SNMPv2c read-only
3. noAuthNoPriv
4. authNoPriv (auth)

Correct Answer(s)

 

A

Rationale

1. The scenario points to authPriv (priv): it provides SNMPv3 authentication together with privacy encryption, satisfying both identity/integrity and confidentiality requirements for management traffic over the untrusted network. The decisive requirement is to require both authenticated SNMPv3 access and encrypted management payloads across an untrusted operations network, which this option directly addresses.
2. SNMPv2c read-only is insufficient here. It can restrict operations to reads but uses a community string and does not provide SNMPv3 authentication plus payload encryption, but the engineer must require both authenticated SNMPv3 access and encrypted management payloads across an untrusted operations network. The needed evidence depends on a different behavior.
3. noAuthNoPriv addresses another management need because it provides neither authentication nor privacy, so it fails both security properties explicitly required by the policy. The case requires the team to require both authenticated SNMPv3 access and encrypted management payloads across an untrusted operations network, so it cannot resolve this symptom.
4. The scenario does not call for authNoPriv (auth). It authenticates and protects integrity but does not encrypt the SNMP payload, leaving the confidentiality requirement unmet, whereas the objective is to require both authenticated SNMPv3 access and encrypted management payloads across an untrusted operations network. That difference makes the option unsuitable.

 

Question 16

A remote site has an unreliable WAN link. Operations wants asynchronous SNMP notifications to be acknowledged so the device can retry if the manager does not confirm receipt. Which notification type should be used? Choose ONE.

1. SNMP GET
2. Syslog console logging
3. SNMP inform
4. SNMP trap

Correct Answer(s)

 

C

Rationale

1. The function of SNMP GET is to is a manager-initiated polling operation rather than an asynchronous device notification for an event. In this case the team must instead use acknowledged and retry-capable asynchronous SNMP notifications across an unreliable WAN, so the feature targets another concern.
2. Syslog console logging fails the scenario fit even though it delivers messages to the local console and does not provide acknowledged SNMP event delivery to the remote manager. The decisive requirement is to use acknowledged and retry-capable asynchronous SNMP notifications across an unreliable WAN, which this choice does not meet.
3. SNMP inform requests an acknowledgment from the SNMP manager and can be retransmitted when a response is not received, improving delivery reliability on the unreliable path. That directly meets the need to use acknowledged and retry-capable asynchronous SNMP notifications across an unreliable WAN, so it is the most targeted diagnostic choice.
4. SNMP trap is an adjacent feature. It is sent without an acknowledgment, so the agent cannot know whether the manager received the notification or retry based on missing confirmation, while the maintenance task is to use acknowledged and retry-capable asynchronous SNMP notifications across an unreliable WAN. That purpose mismatch prevents a direct answer.

 

Question 17

A high-volume event source can tolerate occasional missed notifications, and minimizing device memory and retransmission overhead is more important than confirmed delivery. Which SNMP notification type is preferable? Choose ONE.

1. SNMP inform
2. SNMP SET
3. Extended ping
4. SNMP trap

Correct Answer(s)

 

D

Rationale

1. SNMP inform can help in other incidents because it adds acknowledgment tracking and possible retries, consuming more device and network resources than the requirement calls for. It is not equivalent where the engineer needs to minimize notification state and retransmission overhead when occasional loss is acceptable.
2. This distractor is valid elsewhere: SNMP SET is used by a manager to change writable MIB objects and is not an asynchronous event-notification mechanism. The requirement here is to minimize notification state and retransmission overhead when occasional loss is acceptable, so it does not act on the same condition.
3. Extended ping should be ruled out because it tests IP reachability but does not deliver management events from the agent to the network management system. The troubleshooting goal is to minimize notification state and retransmission overhead when occasional loss is acceptable, and this feature answers a different question.
4. Use SNMP trap, which is sent once without waiting for an acknowledgment, so it imposes less state and retry overhead than an inform when guaranteed receipt is not required. That behavior supports the need to minimize notification state and retransmission overhead when occasional loss is acceptable and produces the relevant evidence or control.

 

Question 18

Users report gradually worsening performance on one uplink. The NMS can poll SNMP counters every minute. Which approach best determines whether interface errors are accumulating over time? Choose ONE.

1. Increase syslog severity to debugging
2. Compare successive SNMP interface-counter samples
3. Read a single counter value once
4. Send one traceroute to the default gateway

Correct Answer(s)

 

B

Rationale

1. Increase syslog severity to debugging is not supported by the stated constraint. It may create more messages yet does not directly measure the change in the specific SNMP interface error counters. The case requires the engineer to determine whether interface errors are increasing over time using one-minute SNMP polling, so it misses the symptom.
2. Compare successive SNMP interface-counter samples is the direct fit because it turns monotonically increasing error counters into a rate or delta over time, showing whether faults are actively accumulating rather than relying on one isolated snapshot. Here the engineer must determine whether interface errors are increasing over time using one-minute SNMP polling, so the mechanism matches the required layer.
3. Read a single counter value once solves another problem because it shows the current total but cannot establish whether errors are still increasing during the reported degradation. The current case depends on the need to determine whether interface errors are increasing over time using one-minute SNMP polling, which requires a different mechanism.
4. Using Send one traceroute to the default gateway would not close the investigation. It can reveal a path but does not quantify physical or data-link interface errors accumulating on the selected uplink, while the team still needs to determine whether interface errors are increasing over time using one-minute SNMP polling. Those tasks are not equivalent.

 

Question 19

A legacy monitoring platform must use SNMPv2c, but it should be able to read status only and must not modify device MIB objects. Which access choice best fits? Choose ONE.

1. A read-only SNMP community
2. SNMPv3 authPriv user
3. An unrestricted syslog host
4. A read-write SNMP community

Correct Answer(s)

 

A

Rationale

1. The correct choice is A read-only SNMP community. It allows GET-style monitoring while preventing SET operations through that community, matching the requirement for legacy v2c observation without configuration changes, matching the requirement to permit legacy SNMPv2c monitoring reads while preventing management writes through the same community without changing an unrelated function.
2. SNMPv3 authPriv user serves another purpose because it would provide stronger security, but the stated platform constraint requires SNMPv2c rather than a change to version 3. The scenario instead asks how to permit legacy SNMPv2c monitoring reads while preventing management writes through the same community, so it cannot provide the needed result.
3. An unrestricted syslog host receives event messages and does not provide the manager with read-only access to requested MIB objects, while the case requires the team to permit legacy SNMPv2c monitoring reads while preventing management writes through the same community. Those mechanisms address different conditions, making this a distractor.
4. Do not choose A read-write SNMP community. It authorizes SET operations and therefore grants the modification capability that the requirement explicitly forbids. The current task is to permit legacy SNMPv2c monitoring reads while preventing management writes through the same community, which this option does not test or control.

 

Question 20

An SNMPv3 group should be allowed to read interface and system objects but not sensitive configuration branches in the MIB tree. Which SNMP mechanism is designed to restrict accessible OID subtrees? Choose ONE.

1. A syslog facility
2. A traceroute TTL
3. A ping repeat count
4. An SNMP view

Correct Answer(s)

 

D

Rationale

1. The role of A syslog facility is that it categorizes logging messages for a logging server but has no role in deciding which SNMP object identifiers a user may access. That does not satisfy the need to restrict an SNMPv3 group’s readable MIB tree to approved system and interface OID subtrees, leaving the decisive condition untested.
2. Reject A traceroute TTL here. It controls probe lifetime during path discovery and is unrelated to MIB authorization or SNMP object visibility; the engineer instead needs to restrict an SNMPv3 group’s readable MIB tree to approved system and interface OID subtrees. The two actions answer different operational questions.
3. A ping repeat count does not match the evidence because it changes how many ICMP probes are sent and cannot enforce access controls on SNMP MIB subtrees. The requirement is to restrict an SNMPv3 group’s readable MIB tree to approved system and interface OID subtrees, so the option works on another function.
4. The scenario points to An SNMP view: it defines included and excluded MIB subtrees that can be associated with an SNMP group, limiting which object identifiers the user can access. The decisive requirement is to restrict an SNMPv3 group’s readable MIB tree to approved system and interface OID subtrees, which this option directly addresses.

• < Cisco CCNP 350-401 ENCOR Multicast: RPF, PIM-SM, IGMPv2/v3, SSM, Bidir, and MSDP Practice Test 2
• Cisco CCNP 350-401 ENCOR Diagnostics, Debugs, Ping/Traceroute, SNMP, and Syslog Practice Test 2 >