Free Cisco 500-220 Actual Exam Questions - Question 11 Discussion

Good point on syslog details missing, so B seems safest for enabling hits count. B

I think D can be ruled out because it looks like a typo and inbound vs outbound flow matters here. A seems off without a syslog sender explicitly mentioned. B makes the most sense since enabling logging usually tracks hits on the rule. B

It’s B because enabling logging here usually means the rule starts recording hits, not sending info to syslog servers. The question is about what happens when logging is enabled, and from experience, that mostly refers to tracking counters on the rule itself. There’s no clear mention of syslog senders or flow directions in the exhibit, so options A and D seem off. Also, C can be eliminated since logging doesn’t equate to enabling the actual firewall rule. So the simplest answer is B—logging turns on the hit counter for that rule.

B imo. The exhibit’s logging setting looks like it just turns on the hits counter tracking for that rule, which is often labeled as “logging” in some firewall GUIs. Since there’s no mention of syslog servers or flow direction details shown, it makes less sense to pick A or D. Also, C can be ruled out because enabling logging isn’t the same as enabling the entire firewall rule itself. So, enabling logging here probably means activating the hit counts for monitoring purposes rather than sending flows to syslog or toggling the rule state.

Option A makes more sense since logging usually refers to outbound flow data being sent to syslog. The typo in D is a clear giveaway to skip that one.

A. The option clearly mentions outbound flows being logged to a syslog server, which fits the typical logging behavior better than D, especially since D’s wording is off and inbound logging is less common here.

A vs D? Both mention syslog servers but D has a typo ("if a syslog server configured"). A's wording seems cleaner, so probably A. B and C don’t relate to logging directly.