Cisco CCNP 350-401 ENCOR Diagnostics, Debugs, Ping/Traceroute, SNMP, and Syslog Practice Test 2

 

Topic 13 Practice Test 2 covers Diagnostics, Debugs, Ping/Traceroute, SNMP, and Syslog for Cisco 350-401 ENCOR. For broader exam preparation, review the Cisco 350-401 ENCOR Exam Dumps. Every option includes focused technical reasoning explaining both the Cisco enterprise networking concept and its fit to the scenario.

Question 1

Packet loss is reported as intermittent rather than complete. A single five-packet ping often looks clean. The engineer wants a simple probe that better quantifies the loss percentage over the next minute. What should be changed? Choose ONE.

1. Lower the syslog trap severity
2. Increase the ping repeat count
3. Enable SNMP write access
4. Disable ICMP redirects

Correct Answer(s)

 

B

Rationale

1. Lower the syslog trap severity addresses another management need because it changes log filtering and does not increase the number of reachability samples used to calculate packet loss. The case requires the team to measure intermittent packet loss with a larger ICMP sample rather than relying on the default small ping set, so it cannot resolve this symptom.
2. Increase the ping repeat count collects a larger sample of echo probes, making intermittent loss visible in the success ratio without changing the forwarding path being tested. That directly meets the need to measure intermittent packet loss with a larger ICMP sample rather than relying on the default small ping set, so it is the most targeted diagnostic choice.
3. The scenario does not call for Enable SNMP write access. It adds management modification privileges but does not improve the statistical sample of ICMP connectivity probes, whereas the objective is to measure intermittent packet loss with a larger ICMP sample rather than relying on the default small ping set. That difference makes the option unsuitable.
4. Disable ICMP redirects is insufficient here. It changes a routing optimization behavior and does not provide more observations of the intermittent loss condition, but the engineer must measure intermittent packet loss with a larger ICMP sample rather than relying on the default small ping set. The needed evidence depends on a different behavior.

 

Question 2

Cisco ping output for a destination contains periods (`.`) for several probes. What does a period represent? Choose ONE.

1. The source interface was administratively down
2. An ICMP destination-unreachable message was returned
3. An echo reply was received successfully
4. The probe timed out before a reply was received

Correct Answer(s)

 

D

Rationale

1. The source interface was administratively down fails the scenario fit even though it might cause reachability failure, but the period itself does not prove that particular local interface state. The decisive requirement is to interpret periods in Cisco ping output for failed probes, which this choice does not meet.
2. An ICMP destination-unreachable message was returned is an adjacent feature. It is represented by `U` in Cisco ping output, not the period shown in this result, while the maintenance task is to interpret periods in Cisco ping output for failed probes. That purpose mismatch prevents a direct answer.
3. The function of An echo reply was received successfully is to is represented by an exclamation mark, so a period is evidence of a missing timely reply rather than success. In this case the team must instead interpret periods in Cisco ping output for failed probes, so the feature targets another concern.
4. Use The probe timed out before a reply was received, which matches Cisco ping notation in which a period indicates that no response arrived before the echo-probe timer expired. That behavior supports the need to interpret periods in Cisco ping output for failed probes and produces the relevant evidence or control.

 

Question 3

A path problem affects traffic sourced from a loopback used by routing protocols, while a normal traceroute sourced from the egress interface looks healthy. Which diagnostic change best reproduces the affected traffic? Choose ONE.

1. Run an extended traceroute using the loopback as the source
2. Increase the logging buffer size
3. Poll CPU utilization with SNMP
4. Run the same default-source traceroute again

Correct Answer(s)

 

A

Rationale

1. Run an extended traceroute using the loopback as the source is the direct fit because it tests the route and return behavior using the same source identity as the affected control-plane traffic while still providing hop-by-hop path evidence. Here the engineer must trace the path using the routing-protocol loopback source rather than the default egress-interface source, so the mechanism matches the required layer.
2. This distractor is valid elsewhere: Increase the logging buffer size retains more local messages but does not change traceroute’s source identity or reveal source-dependent forwarding behavior. The requirement here is to trace the path using the routing-protocol loopback source rather than the default egress-interface source, so it does not act on the same condition.
3. Poll CPU utilization with SNMP should be ruled out because it may identify load but does not reproduce the path taken by packets sourced from the affected loopback. The troubleshooting goal is to trace the path using the routing-protocol loopback source rather than the default egress-interface source, and this feature answers a different question.
4. Run the same default-source traceroute again can help in other incidents because it repeats evidence already known to look healthy and still does not reproduce the source address associated with the failure. It is not equivalent where the engineer needs to trace the path using the routing-protocol loopback source rather than the default egress-interface source.

 

Question 4

Traceroute reaches the destination host, which responds that the probed UDP port is unreachable. Why does that response commonly indicate successful completion of a classic IOS traceroute? Choose ONE.

1. It proves the destination has no IP route back to the source
2. It means every intermediate router blocked the probes
3. The destination received the probe and rejected the deliberately unused UDP port
4. It is generated by the SNMP agent after a failed poll

Correct Answer(s)

 

C

Rationale

1. It proves the destination has no IP route back to the source solves another problem because it would prevent a useful terminal reply and conflicts with the fact that the destination’s ICMP response returned to the traceroute source. The current case depends on the need to interpret a destination port-unreachable response at the end of a classic UDP traceroute, which requires a different mechanism.
2. Using It means every intermediate router blocked the probes would not close the investigation. It is inconsistent with the trace reaching the destination and receiving the expected terminal ICMP response, while the team still needs to interpret a destination port-unreachable response at the end of a classic UDP traceroute. Those tasks are not equivalent.
3. The correct choice is The destination received the probe and rejected the deliberately unused UDP port. It is the expected terminal condition for classic UDP traceroute: intermediate routers return TTL-expired messages, while the destination signals that the high-numbered port is not listening, matching the requirement to interpret a destination port-unreachable response at the end of a classic UDP traceroute without changing an unrelated function.
4. It is generated by the SNMP agent after a failed poll is not supported by the stated constraint. It has no relationship to classic traceroute’s deliberately unused UDP destination ports and TTL processing. The case requires the engineer to interpret a destination port-unreachable response at the end of a classic UDP traceroute, so it misses the symptom.

 

Question 5

A broad protocol debug is too noisy, but the fault occurs only when one known peer participates. Which troubleshooting approach best reduces unrelated debug output? Choose ONE.

1. Run SNMP discovery against all interfaces
2. Enable debugging severity for all remote syslog messages
3. Use a conditional debug scoped to the affected peer
4. Clear the logging buffer repeatedly

Correct Answer(s)

 

C

Rationale

1. Run SNMP discovery against all interfaces widens management activity and still does not provide the peer-specific protocol debug evidence needed for this incident, while the case requires the team to reduce a noisy protocol debug to events associated with one known affected peer. Those mechanisms address different conditions, making this a distractor.
2. Do not choose Enable debugging severity for all remote syslog messages. It expands message export and does not constrain the underlying debug to the peer involved in the fault. The current task is to reduce a noisy protocol debug to events associated with one known affected peer, which this option does not test or control.
3. The scenario points to Use a conditional debug scoped to the affected peer: it limits collection to the peer-specific condition so the engineer sees relevant protocol events without processing every unrelated adjacency or session. The decisive requirement is to reduce a noisy protocol debug to events associated with one known affected peer, which this option directly addresses.
4. Clear the logging buffer repeatedly serves another purpose because it removes stored evidence but does not reduce the amount of debug processing or output being generated. The scenario instead asks how to reduce a noisy protocol debug to events associated with one known affected peer, so it cannot provide the needed result.

 

Question 6

Operations wants informational-and-more-severe messages retained in the router’s local memory buffer for post-incident review. Which setting is the direct fit? Choose ONE.

1. logging console informational
2. logging buffered informational
3. logging monitor informational
4. logging trap informational

Correct Answer(s)

 

B

Rationale

1. Reject logging console informational here. It controls what appears on the physical console and does not define the local buffered-log severity threshold; the engineer instead needs to retain informational through emergency messages in the device’s local logging buffer. The two actions answer different operational questions.
2. logging buffered informational sets the local logging buffer threshold to severity 6, retaining informational messages and all numerically lower, more severe levels for later inspection. That directly meets the need to retain informational through emergency messages in the device’s local logging buffer, so it is the most targeted diagnostic choice.
3. logging monitor informational does not match the evidence because it controls message severity delivered to terminal-monitor sessions rather than the persistent in-memory buffer used after the incident. The requirement is to retain informational through emergency messages in the device’s local logging buffer, so the option works on another function.
4. The role of logging trap informational is that it sets the remote syslog export threshold rather than the severity stored in the device’s local memory buffer. That does not satisfy the need to retain informational through emergency messages in the device’s local logging buffer, leaving the decisive condition untested.

 

Question 7

The physical console is being flooded during a failure. Engineers want only error-level and more-severe messages displayed there while leaving remote syslog unchanged. Which command is appropriate? Choose ONE.

1. logging console errors
2. logging trap errors
3. logging buffered errors
4. terminal monitor

Correct Answer(s)

 

A

Rationale

1. Use logging console errors, which limits console output to severity 3 and numerically lower, more severe messages without changing the separately configured remote syslog threshold. That behavior supports the need to restrict only physical-console logging to errors and more severe messages while preserving remote logging behavior and produces the relevant evidence or control.
2. logging trap errors addresses another management need because it changes the threshold for messages sent to remote syslog servers, which the requirement says must remain unchanged. The case requires the team to restrict only physical-console logging to errors and more severe messages while preserving remote logging behavior, so it cannot resolve this symptom.
3. The scenario does not call for logging buffered errors. It changes the local memory buffer threshold instead of controlling the messages printed on the console, whereas the objective is to restrict only physical-console logging to errors and more severe messages while preserving remote logging behavior. That difference makes the option unsuitable.
4. terminal monitor is insufficient here. It enables log display on a VTY session and does not set the severity threshold for the physical console, but the engineer must restrict only physical-console logging to errors and more severe messages while preserving remote logging behavior. The needed evidence depends on a different behavior.

 

Question 8

An SSH user has already issued `terminal monitor`. The team now wants that VTY to receive warnings and more-severe system messages, but not notifications or informational/debugging messages. Which global setting controls the monitor-session threshold? Choose ONE.

1. logging buffered warnings
2. logging console warnings
3. logging trap warnings
4. logging monitor warnings

Correct Answer(s)

 

D

Rationale

1. logging buffered warnings fails the scenario fit even though it governs local memory storage rather than messages forwarded to an SSH session that is monitoring logs. The decisive requirement is to limit terminal-monitor VTY output to warnings and more severe system messages, which this choice does not meet.
2. logging console warnings is an adjacent feature. It filters physical-console delivery and does not control the severity sent to virtual terminal monitoring sessions, while the maintenance task is to limit terminal-monitor VTY output to warnings and more severe system messages. That purpose mismatch prevents a direct answer.
3. The function of logging trap warnings is to sets the remote syslog server threshold, leaving VTY monitor severity unaffected. In this case the team must instead limit terminal-monitor VTY output to warnings and more severe system messages, so the feature targets another concern.
4. logging monitor warnings is the direct fit because it sets the severity delivered to terminal-monitor sessions at warning level 4, including more-severe levels while excluding 5 through 7. Here the engineer must limit terminal-monitor VTY output to warnings and more severe system messages, so the mechanism matches the required layer.

 

Question 9

A syslog record carries severity number 3. Which standard severity name corresponds to that value? Choose ONE.

1. Warnings
2. Informational
3. Errors
4. Critical

Correct Answer(s)

 

C

Rationale

1. This distractor is valid elsewhere: Warnings corresponds to severity 4, which is numerically higher and less severe than the value in this record. The requirement here is to map syslog numeric severity 3 to its standard severity name, so it does not act on the same condition.
2. Informational should be ruled out because it corresponds to severity 6 and therefore does not match the numeric code reported by the syslog message. The troubleshooting goal is to map syslog numeric severity 3 to its standard severity name, and this feature answers a different question.
3. The correct choice is Errors. It is the standard syslog severity name for numeric level 3, positioned below critical level 2 and above warnings level 4, matching the requirement to map syslog numeric severity 3 to its standard severity name without changing an unrelated function.
4. Critical can help in other incidents because it corresponds to severity 2 rather than the level 3 value present in the message. It is not equivalent where the engineer needs to map syslog numeric severity 3 to its standard severity name.

 

Question 10

A junior engineer assumes a higher syslog number means a more severe condition. Which statement correctly describes the IOS/syslog scale? Choose ONE.

1. Lower numeric values represent more severe conditions
2. Higher numeric values represent more severe conditions
3. Only even-numbered severities are exported remotely
4. Severity numbers apply only to SNMP traps

Correct Answer(s)

 

A

Rationale

1. The scenario points to Lower numeric values represent more severe conditions: it matches the 0-to-7 syslog scale, where emergencies at 0 are most severe and debugging at 7 is least severe. The decisive requirement is to correctly interpret the direction of severity on the standard 0-through-7 syslog scale, which this option directly addresses.
2. Higher numeric values represent more severe conditions solves another problem because it reverses the standard ordering and would misclassify debugging level 7 as more severe than emergencies level 0. The current case depends on the need to correctly interpret the direction of severity on the standard 0-through-7 syslog scale, which requires a different mechanism.
3. Using Only even-numbered severities are exported remotely would not close the investigation. It is not a syslog rule; remote export depends on configured thresholds rather than numeric parity, while the team still needs to correctly interpret the direction of severity on the standard 0-through-7 syslog scale. Those tasks are not equivalent.
4. Severity numbers apply only to SNMP traps is not supported by the stated constraint. It is incorrect because IOS system logging itself uses the standard severity numbers in syslog messages. The case requires the engineer to correctly interpret the direction of severity on the standard 0-through-7 syslog scale, so it misses the symptom.

 

Question 11

Policy requires SNMPv3 message authentication and integrity, but the payload is allowed to remain unencrypted on a dedicated management network. Which security level matches that requirement? Choose ONE.

1. SNMPv2c read-write
2. noAuthNoPriv
3. authPriv (priv)
4. authNoPriv (auth)

Correct Answer(s)

 

D

Rationale

1. SNMPv2c read-write uses community-based access rather than SNMPv3 authentication and also grants write capability that was not requested, while the case requires the team to require SNMPv3 authentication and integrity without payload encryption on a dedicated management network. Those mechanisms address different conditions, making this a distractor.
2. Do not choose noAuthNoPriv. It omits authentication entirely and therefore fails the stated requirement to validate the SNMPv3 user and message integrity. The current task is to require SNMPv3 authentication and integrity without payload encryption on a dedicated management network, which this option does not test or control.
3. authPriv (priv) serves another purpose because it adds privacy encryption beyond the requirement; it is stronger, but it does not match the requested no-encryption security profile. The scenario instead asks how to require SNMPv3 authentication and integrity without payload encryption on a dedicated management network, so it cannot provide the needed result.
4. authNoPriv (auth) authenticates SNMPv3 messages without enabling privacy encryption, matching a requirement for identity/integrity protection while permitting cleartext payload content. That directly meets the need to require SNMPv3 authentication and integrity without payload encryption on a dedicated management network, so it is the most targeted diagnostic choice.

 

Question 12

A lab device uses SNMPv3 only for non-sensitive testing and neither authentication nor encryption is required. Which security level describes that mode? Choose ONE.

1. authPriv
2. noAuthNoPriv
3. SNMPv2c trap
4. authNoPriv

Correct Answer(s)

 

B

Rationale

1. Reject authPriv here. It requires both authentication and privacy encryption and therefore does not describe the requested minimal SNMPv3 security level; the engineer instead needs to select the SNMPv3 mode with neither authentication nor encryption for a non-sensitive lab. The two actions answer different operational questions.
2. Use noAuthNoPriv, which is the SNMPv3 level that provides neither user authentication nor privacy encryption, exactly matching the intentionally unsecured lab requirement. That behavior supports the need to select the SNMPv3 mode with neither authentication nor encryption for a non-sensitive lab and produces the relevant evidence or control.
3. SNMPv2c trap does not match the evidence because it uses a different SNMP version and notification type rather than naming an SNMPv3 security level. The requirement is to select the SNMPv3 mode with neither authentication nor encryption for a non-sensitive lab, so the option works on another function.
4. The role of authNoPriv is that it requires authentication, adding a security property that the lab profile explicitly says is not being used. That does not satisfy the need to select the SNMPv3 mode with neither authentication nor encryption for a non-sensitive lab, leaving the decisive condition untested.

 

Question 13

After an administrator changes the local SNMP engine ID, previously configured SNMPv3 users can no longer authenticate. What is the most likely required remediation? Choose ONE.

1. Reconfigure SNMPv3 users after the engine-ID change
2. Increase the syslog logging buffer
3. Run traceroute to the manager
4. Convert the users to SNMPv1 informs

Correct Answer(s)

 

A

Rationale

1. Reconfigure SNMPv3 users after the engine-ID change is the direct fit because it is required because SNMPv3 authentication/privacy digests are derived using the engine ID; changing it invalidates the previously localized user keys. Here the engineer must restore SNMPv3 authentication after changing the device’s local SNMP engine ID, so the mechanism matches the required layer.
2. Increase the syslog logging buffer addresses another management need because it does not change SNMPv3 localized authentication keys and therefore cannot repair user authentication after an engine-ID change. The case requires the team to restore SNMPv3 authentication after changing the device’s local SNMP engine ID, so it cannot resolve this symptom.
3. The scenario does not call for Run traceroute to the manager. It can verify IP path reachability but will not regenerate the user credentials tied cryptographically to the SNMP engine ID, whereas the objective is to restore SNMPv3 authentication after changing the device’s local SNMP engine ID. That difference makes the option unsuitable.
4. Convert the users to SNMPv1 informs is insufficient here. It is not valid because SNMPv1 does not support informs and would also abandon the SNMPv3 security model, but the engineer must restore SNMPv3 authentication after changing the device’s local SNMP engine ID. The needed evidence depends on a different behavior.

 

Question 14

A design requires acknowledged SNMP notifications, but the device is restricted to SNMPv1. Which conclusion is correct? Choose ONE.

1. Syslog severity must first be set to debugging
2. SNMPv1 informs work if the community is read-write
3. SNMPv1 informs work only over TCP
4. SNMPv1 cannot send informs, so a newer SNMP version is required

Correct Answer(s)

 

D

Rationale

1. Syslog severity must first be set to debugging fails the scenario fit even though it has no effect on which SNMP protocol data units are supported by SNMP version 1. The decisive requirement is to determine whether SNMPv1 can satisfy a requirement for acknowledged inform notifications, which this choice does not meet.
2. SNMPv1 informs work if the community is read-write is an adjacent feature. It is false because inform support is a protocol-version capability and is not enabled by granting write access to a community, while the maintenance task is to determine whether SNMPv1 can satisfy a requirement for acknowledged inform notifications. That purpose mismatch prevents a direct answer.
3. The function of SNMPv1 informs work only over TCP is to is not a supported workaround; transport selection does not add an inform operation that SNMPv1 lacks. In this case the team must instead determine whether SNMPv1 can satisfy a requirement for acknowledged inform notifications, so the feature targets another concern.
4. The correct choice is SNMPv1 cannot send informs, so a newer SNMP version is required. It reflects the protocol limitation: informs are not supported by SNMPv1, so acknowledged notification behavior requires a supported later version, matching the requirement to determine whether SNMPv1 can satisfy a requirement for acknowledged inform notifications without changing an unrelated function.

 

Question 15

A switch has an SNMP manager configured, but link-state notifications are not generated because that notification category was never enabled. Which type of configuration is missing? Choose ONE.

1. Configure a syslog source interface
2. Add a static default route to the MIB
3. Enable the required SNMP trap/notification type
4. Increase the ping timeout

Correct Answer(s)

 

C

Rationale

1. This distractor is valid elsewhere: Configure a syslog source interface stabilizes the source address of syslog packets and does not enable an SNMP notification category. The requirement here is to enable generation of the required SNMP event category in addition to having a manager destination, so it does not act on the same condition.
2. Add a static default route to the MIB should be ruled out because it is not a valid way to enable SNMP traps and confuses routing configuration with management-event generation. The troubleshooting goal is to enable generation of the required SNMP event category in addition to having a manager destination, and this feature answers a different question.
3. The scenario points to Enable the required SNMP trap/notification type: it activates generation of the selected event notification category; defining a recipient alone does not necessarily enable every desired trap source. The decisive requirement is to enable generation of the required SNMP event category in addition to having a manager destination, which this option directly addresses.
4. Increase the ping timeout can help in other incidents because it changes ICMP probe behavior and cannot enable the SNMP agent to generate link-state event notifications. It is not equivalent where the engineer needs to enable generation of the required SNMP event category in addition to having a manager destination.

 

Question 16

The SNMP agent should send notifications to 198.51.100.25 using SNMPv3 and the selected trap/inform behavior. Which configuration element identifies that notification receiver and version? Choose ONE.

1. snmp-server view
2. snmp-server host
3. logging host
4. terminal monitor

Correct Answer(s)

 

B

Rationale

198. snmp-server view solves another problem because it controls accessible MIB subtrees and does not name the remote manager that should receive notifications. The current case depends on the need to identify 198.51.100.25 as the SNMP notification receiver and specify version/notification behavior, which requires a different mechanism.
199. snmp-server host defines the destination manager and can specify traps or informs, SNMP version, security level, and user/community details for notifications. That directly meets the need to identify 198.51.100.25 as the SNMP notification receiver and specify version/notification behavior, so it is the most targeted diagnostic choice.
200. Using logging host would not close the investigation. It identifies a syslog collector, not an SNMP manager or the SNMP version used for notifications, while the team still needs to identify 198.51.100.25 as the SNMP notification receiver and specify version/notification behavior. Those tasks are not equivalent.
201. terminal monitor is not supported by the stated constraint. It affects message display on the current VTY and is unrelated to remote SNMP notification delivery. The case requires the engineer to identify 198.51.100.25 as the SNMP notification receiver and specify version/notification behavior, so it misses the symptom.

 

Question 17

The NMS needs interface utilization every five minutes even when no fault event occurs. Which management behavior supplies that periodic state? Choose ONE.

1. Run traceroute only when users complain
2. Rely only on SNMP traps
3. Rely only on syslog errors
4. Manager-initiated SNMP polling

Correct Answer(s)

 

D

Rationale

1. Run traceroute only when users complain provides path diagnostics on demand and cannot create the continuous utilization history required by the NMS, while the case requires the team to collect interface utilization on a fixed five-minute schedule even when no event occurs. Those mechanisms address different conditions, making this a distractor.
2. Do not choose Rely only on SNMP traps. It delivers event-driven notifications but does not guarantee periodic counter samples when the interface remains healthy and quiet. The current task is to collect interface utilization on a fixed five-minute schedule even when no event occurs, which this option does not test or control.
3. Rely only on syslog errors serves another purpose because it captures selected event messages rather than a regular time series of interface utilization counters. The scenario instead asks how to collect interface utilization on a fixed five-minute schedule even when no event occurs, so it cannot provide the needed result.
4. Use Manager-initiated SNMP polling, which actively requests interface counters on a schedule, providing regular utilization samples regardless of whether the device has an asynchronous event to report. That behavior supports the need to collect interface utilization on a fixed five-minute schedule even when no event occurs and produces the relevant evidence or control.

 

Question 18

A message appears as `%LINK-3-UPDOWN: Interface GigabitEthernet1/0/10, changed state to down`. Which part of the syslog record indicates the severity? Choose ONE.

1. The `3` between the facility and mnemonic
2. The word `UPDOWN`
3. The interface number `1/0/10`
4. The word `LINK`

Correct Answer(s)

 

A

Rationale

3. The `3` between the facility and mnemonic is the direct fit because it is the numeric severity in the standard `%FACILITY-SEVERITY-MNEMONIC` structure, identifying this LINK event as severity 3. Here the engineer must identify the severity field inside a standard IOS syslog facility-severity-mnemonic message, so the mechanism matches the required layer.
4. Reject The word `UPDOWN` here. It is the mnemonic that identifies the specific event type rather than the message severity level; the engineer instead needs to identify the severity field inside a standard IOS syslog facility-severity-mnemonic message. The two actions answer different operational questions.
5. The interface number `1/0/10` does not match the evidence because it is part of the event description and has no relationship to syslog severity encoding. The requirement is to identify the severity field inside a standard IOS syslog facility-severity-mnemonic message, so the option works on another function.
6. The role of The word `LINK` is that it is the facility that identifies the subsystem generating the message, not the numeric severity. That does not satisfy the need to identify the severity field inside a standard IOS syslog facility-severity-mnemonic message, leaving the decisive condition untested.

 

Question 19

A router has a separate management VRF and the engineer needs to test reachability to the NMS using that routing table rather than the global table. Which diagnostic approach is appropriate? Choose ONE.

1. Run a global-table ping only
2. Change syslog severity to emergencies
3. Run ping in the management VRF context
4. Create an SNMP read-write community

Correct Answer(s)

 

C

Rationale

1. Run a global-table ping only addresses another management need because it can succeed or fail for a different routing context and therefore may not represent the path used by management traffic in the VRF. The case requires the team to test NMS reachability using the management VRF routing table rather than the global routing table, so it cannot resolve this symptom.
2. The scenario does not call for Change syslog severity to emergencies. It filters messages and does not select which routing table an ICMP reachability probe uses, whereas the objective is to test NMS reachability using the management VRF routing table rather than the global routing table. That difference makes the option unsuitable.
3. The correct choice is Run ping in the management VRF context. It forces the reachability test to use the same VRF routing information as the management traffic, avoiding a false result from the global routing table, matching the requirement to test NMS reachability using the management VRF routing table rather than the global routing table without changing an unrelated function.
4. Create an SNMP read-write community is insufficient here. It changes management authorization and cannot make a connectivity test use the correct VRF routing context, but the engineer must test NMS reachability using the management VRF routing table rather than the global routing table. The needed evidence depends on a different behavior.

 

Question 20

An IPv6 neighbor is addressed only by a link-local address and the router has several IPv6-enabled interfaces. What additional information is necessary for a reliable ping to that link-local target? Choose ONE.

1. A larger IPv4 ping payload
2. The outgoing interface for the link-local scope
3. A remote syslog facility number
4. An SNMP engine ID

Correct Answer(s)

 

B

Rationale

1. A larger IPv4 ping payload fails the scenario fit even though it tests a different protocol and cannot identify the interface scope of an IPv6 link-local destination. The decisive requirement is to ping an IPv6 link-local address when multiple local interfaces could provide the relevant link scope, which this choice does not meet.
2. The scenario points to The outgoing interface for the link-local scope: it disambiguates which local link contains the `fe80::/10` destination because identical link-local addresses can exist on different interfaces and are not globally routable. The decisive requirement is to ping an IPv6 link-local address when multiple local interfaces could provide the relevant link scope, which this option directly addresses.
3. A remote syslog facility number is an adjacent feature. It has no relationship to the interface scope required for IPv6 link-local forwarding, while the maintenance task is to ping an IPv6 link-local address when multiple local interfaces could provide the relevant link scope. That purpose mismatch prevents a direct answer.
4. The function of An SNMP engine ID is to identifies an SNMP engine for management security and does not select the link used by an IPv6 ping. In this case the team must instead ping an IPv6 link-local address when multiple local interfaces could provide the relevant link scope, so the feature targets another concern.

• < Cisco CCNP 350-401 ENCOR Diagnostics, Debugs, Ping/Traceroute, SNMP, and Syslog Practice Test 1
• Cisco CCNP 350-401 ENCOR Flexible NetFlow, SPAN/RSPAN/ERSPAN, and IP SLA Practice Test 1 >