Skip to content
AvailabilitySign inBook a DemoJoin Waitlist
All CCNA topics

4.0 Network Services and Security

SSH & Syslog Practice Questions

Updated for CCNA v2.0

Secure remote management and centralized logging.

Author-reviewed by LabFabric · 7 September 2026 · Report a content issue

One solved question, so you can see how these are marked

A Cisco IOS switch already has a nondefault hostname. Which remaining identity command is required by the traditional hostname-and-domain RSA key-generation workflow for SSH?

ip domain name <name>

The traditional IOS SSH setup uses a configured hostname and ip domain name before generating RSA keys. Keys, authentication, and VTY transport restrictions are separate requirements. Some newer platforms also support labeled-key workflows, so the premise deliberately names the traditional method.

Every question in the set below is marked like this. The answers stay hidden until you pick one.

Find related practice in the CCNA path
All 9 SSH & Syslog questions in this set

Answers and explanations appear when you work through the set above.

  1. Telnet still succeeds after transport input ssh is applied to line vty 0 4. show users places the Telnet session on vty 5, whose configuration still permits Telnet. What fixes the gap?

    • Nothing, Telnet is disabled automatically once SSH is configured
    • transport input ssh was already applied but a second command, transport input telnet, needs to be removed explicitly
    • Apply transport input ssh to every VTY line that can accept inbound sessions, including vty 5
    • The device needs ip ssh version 2 configured before transport input takes effect

  2. Which command restricts SSH access on the vty lines to only a specific host defined in an access list?

    • access-class <acl-number> in
    • ip access-group <acl-number> in
    • login local
    • ip ssh access-list <acl-number>

  3. A source does not match any permit in an IPv4 ACL applied with access-class 1 in to the VTY lines. What can the router's configuration establish, regardless of the SSH client's exact error text?

    • Password: prompt followed by successful login
    • The inbound VTY session is denied by the access-class policy
    • % Invalid input detected
    • % Ambiguous command

  4. Which logging severity level corresponds to the keyword "debugging" in Cisco IOS syslog?

    • Level 0
    • Level 4
    • Level 6
    • Level 7

  5. An engineer configures logging host 192.168.1.100 and logging trap debugging on a router. What is the effect of these two commands together?

    • The router stores debugging level and higher messages only in its internal buffer
    • The router forwards syslog messages at debugging severity and higher urgency to the external syslog server at 192.168.1.100
    • The router disables console logging and only shows messages via SSH
    • The router sends only emergency level messages to the syslog server

  6. Monitor logging is configured for VTY sessions, but the current SSH terminal is not displaying live log messages. Which per-session command enables their display?

    • terminal monitor
    • logging buffered
    • show logging
    • terminal length 0

  7. Which command configures a router to store the most recent syslog messages in RAM with a buffer size of 8192 bytes?

    • logging buffered 8192
    • logging history 8192
    • logging file 8192
    • logging console 8192

  8. Why would an engineer add service timestamps log datetime msec to a router's configuration before troubleshooting an intermittent outage?

    • It increases the syslog severity level so more messages are captured
    • It adds a precise date, time, and millisecond stamp to each logged event, making it easier to correlate the exact sequence of failures
    • It forces all syslog messages to be sent to an external server automatically
    • It is required before logging can be enabled at all

  9. A switch is configured with login local under line vty 0 15 but no local usernames have been created. What happens when someone attempts to SSH into the switch?

    • The connection succeeds with no authentication required
    • The switch falls back to using the enable secret automatically
    • The connection is accepted but authentication always fails, since there is no local user database to check against
    • SSH access is disabled entirely until a username is created