Courseiva
Knowledge + Practice
CertificationsVendorsCareer RoadmapsLabs & ToolsStudy GuidesGlossaryPractice Questions
C
Courseiva

Free IT certification practice questions with explained answers for CCNA, CompTIA, AWS, Azure, Google Cloud, and more.

Certification Practice Questions

CCNA practice questionsSecurity+ SY0-701 practice questionsAWS SAA-C03 practice questionsAZ-104 practice questionsAZ-900 practice questionsCLF-C02 practice questionsA+ Core 1 practice questionsGoogle Cloud ACE practice questionsCySA+ CS0-003 practice questionsNetwork+ N10-009 practice questions
View all certifications →

Product

CertificationsCertification PathsExam TopicsPractice TestsExam Dumps vs Practice TestsStudy HubComparisons

Company

AboutContactEditorial PolicyQuestion Writing PolicyTrust Center

Legal

Privacy PolicyTerms of Service

Courseiva is a free IT certification practice platform offering original exam-style practice questions, detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics for Cisco, CompTIA, Microsoft, AWS, and other technology certifications.

© 2026 Courseiva. Courseiva is operated by JTNetSolutions Ltd. All rights reserved.

Courseiva is an independent certification practice platform and is not affiliated with, endorsed by, or sponsored by Cisco, Microsoft, AWS, CompTIA, Google, ISC2, ISACA, or any other certification vendor. Vendor names and certification marks are used only to identify the exams learners are preparing for.

Certifications›300-410›Objectives›Embedded Event Manager (EEM)
Objective 404.0

Embedded Event Manager (EEM)

300-410 Practice Questions

Full Practice Test →All Objectives

300-410 Embedded Event Manager (EEM) — Practice Questions

30 questions from this objective

Question 2mediummultiple choice
Open the full BGP breakdown →

A network engineer is troubleshooting an intermittent BGP session failure between two routers. The BGP session drops every few hours and recovers after a few seconds. The engineer checks the logs and sees that an EEM applet is triggered just before each failure. The applet is configured to run a script that clears the BGP session when a specific syslog message is generated. What is the most likely cause of the BGP session failure?

Question 3mediummultiple choice
Read the full network assurance explanation →

A network engineer notices that a router is sending SNMP traps for interface state changes even when there is no actual interface flapping. The engineer checks the running configuration and finds an EEM applet that monitors interface state changes and sends a syslog message. The applet is configured with a trigger condition that matches any interface state change. What should the engineer do to resolve the issue?

Question 4hardmultiple choice
Read the full network assurance explanation →

A network engineer is troubleshooting a router that fails to apply a specific configuration change after a reload. The engineer has an EEM applet that runs at boot time to apply a set of commands. After a reload, the engineer checks the configuration and finds that the commands were not applied. The applet is configured with event syslog pattern 'SYS-5-RESTART' and action cli command 'configure terminal'. What is the most likely cause of the failure?

Question 5mediummultiple choice
Read the full network assurance explanation →

A network engineer is troubleshooting a router that is experiencing high CPU utilization. The engineer checks the process list and sees that the 'EEM Server' process is consuming a significant amount of CPU. The engineer reviews the EEM configuration and finds multiple applets that are triggered by syslog events. What should the engineer do first to reduce CPU utilization?

Question 6mediummultiple choice
Read the full network assurance explanation →

A network engineer is troubleshooting a router that is not sending SNMP traps for a specific interface down event. The engineer has an EEM applet configured to send an SNMP trap when the interface goes down. The applet uses event syslog pattern 'LINK-3-UPDOWN' and action snmp-trap. The interface goes down, but no trap is sent. What is the most likely cause?

Question 7hardmultiple choice
Read the full network assurance explanation →

A network engineer is troubleshooting a router that is not executing an EEM applet that is supposed to run when a specific interface goes down. The applet is configured with event syslog pattern 'LINK-3-UPDOWN' and matches the interface with a regex. The engineer checks the syslog and sees the message 'LINK-3-UPDOWN: GigabitEthernet0/1, changed state to down' but the applet does not run. What is the most likely cause?

Question 8easymultiple choice
Read the full network assurance explanation →

A network engineer is troubleshooting a router that is sending duplicate SNMP traps for interface state changes. The engineer finds two EEM applets that both trigger on the same syslog pattern 'LINK-3-UPDOWN' and both send SNMP traps. What should the engineer do to resolve the duplicate traps?

Question 9hardmultiple choice
Read the full network assurance explanation →

A network engineer is troubleshooting a router that is not generating any EEM applet actions even though the applets are configured and enabled. The engineer checks the 'show event manager status' command and sees that the EEM server is running. The engineer also checks the syslog and sees that the trigger events are occurring. What is the most likely cause?

Question 10mediummultiple choice
Review the full routing breakdown →

A network engineer is troubleshooting a router that is experiencing intermittent packet loss. The engineer checks the logs and sees that an EEM applet is being triggered frequently. The applet is configured to run a script that modifies the routing table. The engineer suspects the applet is causing the packet loss. What should the engineer do to verify the root cause?

Question 11mediummultiple choice
Review the full OSPF breakdown →

A network engineer runs the following command on Router R1:

R1# show event manager policy registered

No. Type Time Created Name 1 applet 00:01:23 UTC Mar 1 2025 EIGRP_Neighbor_Down 2 applet 00:01:23 UTC Mar 1 2025 OSPF_Neighbor_Flap

Based on this output, which statement is correct?

Question 12hardmultiple choice
Review the full OSPF breakdown →

A network engineer runs the following command on Router R1:

R1# show event manager history events

Event History: No. Time Type Name 1 00:01:30 UTC Mar 1 syslog EIGRP_Neighbor_Down 2 00:01:31 UTC Mar 1 syslog OSPF_Neighbor_Flap 3 00:01:32 UTC Mar 1 syslog EIGRP_Neighbor_Down 4 00:01:33 UTC Mar 1 syslog OSPF_Neighbor_Flap

Based on this output, what is the most likely problem?

Question 13mediummultiple choice
Open the full BGP breakdown →

A network engineer runs the following command on Router R1:

R1# show event manager policy registered

No. Type Time Created Name 1 applet 00:01:23 UTC Mar 1 2025 BGP_Session_Reset

R1# show event manager history events

Event History: No. Time Type Name 1 00:02:00 UTC Mar 1 syslog BGP_Session_Reset 2 00:02:05 UTC Mar 1 syslog BGP_Session_Reset 3 00:02:10 UTC Mar 1 syslog BGP_Session_Reset

Based on this output, which statement is correct?

Question 14mediummultiple choice
Review the full OSPF breakdown →

A network engineer runs the following command on Router R1:

R1# show event manager policy registered

No. Type Time Created Name 1 applet 00:01:23 UTC Mar 1 2025 OSPF_Neighbor_Down

R1# show ip ospf neighbor

Neighbor ID     Pri   State           Dead Time   Address         Interface
10.1.1.2         1   FULL/DR         00:00:36    192.168.1.2     GigabitEthernet0/0

Based on this output, what is the most likely conclusion?

Question 15mediummultiple choice
Open the full BGP breakdown →

A network engineer runs the following command on Router R1:

R1# show event manager policy registered

No. Type Time Created Name 1 applet 00:01:23 UTC Mar 1 2025 BGP_Neighbor_Down

R1# show bgp summary

BGP router identifier 10.0.0.1, local AS number 65001 BGP table version is 1, main routing table version 1

Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
192.168.1.2     4        65002       5       5        1    0    0 00:02:00 Established

Based on this output, which statement is correct?

Question 16hardmultiple choice
Study the full EIGRP explanation →

A network engineer runs the following command on Router R1:

R1# show event manager policy registered

No. Type Time Created Name 1 applet 00:01:23 UTC Mar 1 2025 EIGRP_Neighbor_Down

R1# show ip eigrp neighbors

IP-EIGRP neighbors for process 100 H Address Interface Hold Uptime SRTT RTO Q Seq (sec) (ms) Cnt Num 0 192.168.1.2 Gi0/0 13 00:02:00 40 200 0 5

Based on this output, what is the most likely problem?

Question 17mediummultiple choice
Review the full OSPF breakdown →

A network engineer runs the following command on Router R1:

R1# show event manager history events

Event History: No. Time Type Name 1 00:01:30 UTC Mar 1 syslog OSPF_Neighbor_Down 2 00:01:31 UTC Mar 1 syslog OSPF_Neighbor_Up 3 00:01:32 UTC Mar 1 syslog OSPF_Neighbor_Down 4 00:01:33 UTC Mar 1 syslog OSPF_Neighbor_Up

Based on this output, which statement is correct?

Question 18easymultiple choice
Study the full EIGRP explanation →

A network engineer runs the following command on Router R1:

R1# show event manager policy registered

No. Type Time Created Name 1 applet 00:01:23 UTC Mar 1 2025 EIGRP_Neighbor_Down

R1# show event manager history events

Event History: No. Time Type Name 1 00:01:30 UTC Mar 1 syslog EIGRP_Neighbor_Down

Based on this output, which statement is correct?

Question 19hardmultiple choice
Open the full BGP breakdown →

A network engineer runs the following command on Router R1:

R1# show event manager policy registered

No. Type Time Created Name 1 applet 00:01:23 UTC Mar 1 2025 BGP_Neighbor_Down

R1# show bgp neighbors 192.168.1.2

BGP neighbor is 192.168.1.2, remote AS 65002, external link BGP version 4, remote router ID 10.0.0.2 BGP state = Idle Last read 00:00:05, hold time is 180, keepalive interval is 60 seconds

Neighbor sessions:

1 active, is not multisession capable

Based on this output, what is the most likely conclusion?

Question 20mediummultiple choice
Review the full OSPF breakdown →

Consider the following EEM applet configuration:

!--- event manager applet CHECK_OSPF event syslog pattern "OSPF-5-ADJCHG" action 1.0 cli command "enable" action 2.0 cli command "show ip ospf neighbor" action 3.0 mail server "smtp.example.com" to "admin@example.com" from "router@example.com" subject "OSPF Adjacency Change" body "An OSPF adjacency change has been detected." !---

What is the effect of this configuration?

Question 21mediummultiple choice
Read the full network assurance explanation →

Examine the following EEM applet configuration:

!--- event manager applet LOGIN_ALERT event syslog occurs 1 period 60 action 1.0 syslog msg "Login event detected" !---

What is the problem with this configuration?

Question 22mediummultiple choice
Read the full network assurance explanation →

Consider the following EEM applet configuration:

!--- event manager applet INTERFACE_DOWN event syslog pattern "%LINEPROTO-5-UPDOWN" action 1.0 if $syslog_severity eq 5 action 2.0 cli command "enable" action 3.0 cli command "clear counters" !---

What will happen when a syslog message matching the pattern is generated?

Question 23mediummultiple choice
Full question →

Examine the following EEM applet configuration:

!--- event manager applet BACKUP_CONFIG event timer watchdog time 86400 action 1.0 cli command "enable" action 2.0 cli command "copy running-config tftp://192.168.1.100/backup.cfg" !---

What is the effect of this configuration?

Question 24mediummultiple choice
Read the full network assurance explanation →

Consider the following EEM applet configuration:

!--- event manager applet HIGH_CPU event snmp oid 1.3.6.1.4.1.9.9.109.1.1.1.1.3.1 get-type exact entry-op gt entry-val 90 poll-interval 10 action 1.0 syslog msg "CPU utilization exceeded 90%" !---

What is the problem with this configuration?

Question 25mediummultiple choice
Read the full network assurance explanation →

Examine the following EEM applet configuration:

!--- event manager applet RELOAD_NOTIFY event syslog pattern "%SYS-5-RELOAD" action 1.0 cli command "enable" action 2.0 cli command "send log "Router is reloading"" !---

What is the effect of this configuration?

Question 26easymultiple choice
Full question →

What is the default behavior of an EEM applet when a 'set' action modifies a variable that is used in a subsequent 'if' condition?

Question 27easymultiple choice
Full question →

Which of the following EEM event types can be used to trigger an applet based on a specific IOS command being entered?

Question 28easymultiple choice
Full question →

What is the maximum number of actions that can be configured in a single EEM applet?

Question 29mediummulti select
Read the full network assurance explanation →

Which TWO commands would a network engineer use to verify the operation of an Embedded Event Manager (EEM) applet that triggers on a syslog pattern? (Choose TWO.)

Question 30mediummulti select
Full question →

Which TWO statements about Embedded Event Manager (EEM) applet configuration are true? (Choose TWO.)

Question 31hardmulti select
Read the full network assurance explanation →

Which THREE symptoms indicate that an Embedded Event Manager (EEM) applet configured to send a syslog message upon interface down has failed to execute? (Choose THREE.)

More Embedded Event Manager (EEM) questions available in the full practice test.

Continue Practising →
←

Previous objective

Network Logging and Syslog

Next objective

IP SLA

→

All 300-410 Objectives

  • 100.Layer 3 Technologies35%
  • 101.EIGRP Troubleshooting
  • 102.OSPF Troubleshooting (v2/v3)
  • 103.BGP Troubleshooting
  • 104.Route Redistribution
  • 105.Policy-Based Routing (PBR)
  • 106.VRF-Lite
  • 107.Route Maps and Route Filtering
  • 108.Administrative Distance
  • 109.Route Summarization
  • 110.Bidirectional Forwarding Detection (BFD)
  • 200.VPN Technologies20%
  • 201.MPLS Operations
  • 202.MPLS L3VPN
  • 203.DMVPN
  • 204.IPsec Site-to-Site VPN
  • 205.IPv6 Tunneling Techniques
  • 300.Infrastructure Security20%
  • 301.Device Access Control
  • 302.IPv4 Access Control Lists
  • 303.IPv6 Traffic Filtering and uRPF
  • 304.Control Plane Policing (CoPP)
  • 305.IPv6 First Hop Security
  • 400.Infrastructure Services25%
  • 401.Device Management
  • 402.SNMP Troubleshooting
  • 403.Network Logging and Syslog
  • 404.Embedded Event Manager (EEM)
  • 405.IP SLA
  • 406.NetFlow and Flexible NetFlow
  • 407.SPAN, RSPAN, and ERSPAN
  • 408.DHCP (IPv4 and IPv6)
  • 409.NAT and PAT