Question

Difficulty: MediumNetwork Logging and Auditing

Match each network logging mechanism or Syslog severity level on the left with its corresponding description or operational characteristic on the right.

  • Syslog Severity 0 (Emergency)Designates a critical panic condition rendering the operating system or device completely unusable.
  • Syslog Severity 4 (Warning)Indicates an abnormal condition that does not currently disrupt service but requires monitoring to prevent failure.
  • NetFlow / IPFIXExports traffic statistics such as source/destination IP addresses, port numbers, and byte counts for auditing network flow.
  • SNMP TrapAn unsolicited alert message sent asynchronously from a managed agent to a central collector upon an event trigger.

Answer

Syslog Severity 0 matches system panic/unusable condition; Syslog Severity 4 matches non-disruptive abnormal warning condition; NetFlow / IPFIX matches export of traffic flow statistics; SNMP Trap matches unsolicited event notifications from agent to collector.
Each logging mechanism and severity rating accurately corresponds to its defining operational definition within enterprise network management.

Step-by-Step Solution

1
Differentiate Syslog severity levels based on numerical values.
Severity 0 corresponds to Emergency (highest severity), while Severity 4 corresponds to Warning.
Syslog RFC standards rank severities from 0 (Emergency) to 7 (Debug).
2
Distinguish between session telemetry and asynchronous alert protocols.
NetFlow aggregates IP session metadata for flow analysis, whereas SNMP Traps transmit asynchronous event notifications.
Flow telemetry measures volume and communication paths, while SNMP traps notify administrators of real-time status changes.

Key Concept

Syslog Severity Levels and Network Logging Telemetry Protocols
Rate this question