Which syslog severity level logs interface line-protocol up/down events?

The correct answer is notifications. Syslog severity level 5, "notifications," is used for significant non-error conditions, such as interface up/down transitions, system reboots, or successful logins. These events are important for monitoring network status but do not indicate a critical problem. "Informational" (level 6) is for routine information, like successful authentication attempts, which are less critical than interface state changes. "Alerts" (level 1) are for conditions that require immediate attention, such as a power supply failure, which is more severe than a simple interface state change. "Debugging" (level 7) is the lowest severity and is used for detailed information typically only relevant during troubleshooting.