300-410 Embedded Event Manager (EEM) — All Questions With Answers

A network engineer is troubleshooting an intermittent BGP session failure between two routers. The BGP session drops every few hours and recovers after a few seconds. The engineer checks the logs and sees that an EEM applet is triggered just before each failure. The applet is configured to run a script that clears the BGP session when a specific syslog message is generated. What is the most likely cause of the BGP session failure?

Question 2mediummultiple choice

A network engineer notices that a router is sending SNMP traps for interface state changes even when there is no actual interface flapping. The engineer checks the running configuration and finds an EEM applet that monitors interface state changes and sends a syslog message. The applet is configured with a trigger condition that matches any interface state change. What should the engineer do to resolve the issue?

Question 3hardmultiple choice

A network engineer is troubleshooting a router that fails to apply a specific configuration change after a reload. The engineer has an EEM applet that runs at boot time to apply a set of commands. After a reload, the engineer checks the configuration and finds that the commands were not applied. The applet is configured with event syslog pattern 'SYS-5-RESTART' and action cli command 'configure terminal'. What is the most likely cause of the failure?

Question 4mediummultiple choice

A network engineer is troubleshooting a router that is experiencing high CPU utilization. The engineer checks the process list and sees that the 'EEM Server' process is consuming a significant amount of CPU. The engineer reviews the EEM configuration and finds multiple applets that are triggered by syslog events. What should the engineer do first to reduce CPU utilization?

Question 5mediummultiple choice

A network engineer is troubleshooting a router that is not sending SNMP traps for a specific interface down event. The engineer has an EEM applet configured to send an SNMP trap when the interface goes down. The applet uses event syslog pattern 'LINK-3-UPDOWN' and action snmp-trap. The interface goes down, but no trap is sent. What is the most likely cause?

Question 6hardmultiple choice

A network engineer is troubleshooting a router that is not executing an EEM applet that is supposed to run when a specific interface goes down. The applet is configured with event syslog pattern 'LINK-3-UPDOWN' and matches the interface with a regex. The engineer checks the syslog and sees the message 'LINK-3-UPDOWN: GigabitEthernet0/1, changed state to down' but the applet does not run. What is the most likely cause?

Question 7easymultiple choice

A network engineer is troubleshooting a router that is sending duplicate SNMP traps for interface state changes. The engineer finds two EEM applets that both trigger on the same syslog pattern 'LINK-3-UPDOWN' and both send SNMP traps. What should the engineer do to resolve the duplicate traps?

Question 8hardmultiple choice

Review the full routing breakdown →

A network engineer is troubleshooting a router that is not generating any EEM applet actions even though the applets are configured and enabled. The engineer checks the 'show event manager status' command and sees that the EEM server is running. The engineer also checks the syslog and sees that the trigger events are occurring. What is the most likely cause?

Question 9mediummultiple choice

A network engineer is troubleshooting a router that is experiencing intermittent packet loss. The engineer checks the logs and sees that an EEM applet is being triggered frequently. The applet is configured to run a script that modifies the routing table. The engineer suspects the applet is causing the packet loss. What should the engineer do to verify the root cause?

Question 10mediummultiple choice

A network engineer runs the following command on Router R1:

R1# show event manager policy registered

No. Type Time Created Name 1 applet 00:01:23 UTC Mar 1 2025 EIGRP_Neighbor_Down 2 applet 00:01:23 UTC Mar 1 2025 OSPF_Neighbor_Flap

Based on this output, which statement is correct?

Question 11hardmultiple choice

A network engineer runs the following command on Router R1:

R1# show event manager history events

Event History: No. Time Type Name 1 00:01:30 UTC Mar 1 syslog EIGRP_Neighbor_Down 2 00:01:31 UTC Mar 1 syslog OSPF_Neighbor_Flap 3 00:01:32 UTC Mar 1 syslog EIGRP_Neighbor_Down 4 00:01:33 UTC Mar 1 syslog OSPF_Neighbor_Flap

Based on this output, what is the most likely problem?

Question 12mediummultiple choice

A network engineer runs the following command on Router R1:

R1# show event manager policy registered

No. Type Time Created Name 1 applet 00:01:23 UTC Mar 1 2025 BGP_Session_Reset

R1# show event manager history events

Event History: No. Time Type Name 1 00:02:00 UTC Mar 1 syslog BGP_Session_Reset 2 00:02:05 UTC Mar 1 syslog BGP_Session_Reset 3 00:02:10 UTC Mar 1 syslog BGP_Session_Reset

Based on this output, which statement is correct?

Question 13mediummultiple choice

A network engineer runs the following command on Router R1:

R1# show event manager policy registered

No. Type Time Created Name 1 applet 00:01:23 UTC Mar 1 2025 OSPF_Neighbor_Down

R1# show ip ospf neighbor

Neighbor ID     Pri   State           Dead Time   Address         Interface
10.1.1.2         1   FULL/DR         00:00:36    192.168.1.2     GigabitEthernet0/0

Based on this output, what is the most likely conclusion?

Question 14mediummultiple choice

Study the full EIGRP explanation →

A network engineer runs the following command on Router R1:

R1# show event manager policy registered

No. Type Time Created Name 1 applet 00:01:23 UTC Mar 1 2025 BGP_Neighbor_Down

R1# show bgp summary

BGP router identifier 10.0.0.1, local AS number 65001 BGP table version is 1, main routing table version 1

Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
192.168.1.2     4        65002       5       5        1    0    0 00:02:00 Established

Based on this output, which statement is correct?

Question 15hardmultiple choice

A network engineer runs the following command on Router R1:

R1# show event manager policy registered

No. Type Time Created Name 1 applet 00:01:23 UTC Mar 1 2025 EIGRP_Neighbor_Down

R1# show ip eigrp neighbors

IP-EIGRP neighbors for process 100 H Address Interface Hold Uptime SRTT RTO Q Seq (sec) (ms) Cnt Num 0 192.168.1.2 Gi0/0 13 00:02:00 40 200 0 5

Based on this output, what is the most likely problem?

Question 16mediummultiple choice

Study the full EIGRP explanation →

A network engineer runs the following command on Router R1:

R1# show event manager history events

Event History: No. Time Type Name 1 00:01:30 UTC Mar 1 syslog OSPF_Neighbor_Down 2 00:01:31 UTC Mar 1 syslog OSPF_Neighbor_Up 3 00:01:32 UTC Mar 1 syslog OSPF_Neighbor_Down 4 00:01:33 UTC Mar 1 syslog OSPF_Neighbor_Up

Based on this output, which statement is correct?

Question 17easymultiple choice

A network engineer runs the following command on Router R1:

R1# show event manager policy registered

No. Type Time Created Name 1 applet 00:01:23 UTC Mar 1 2025 EIGRP_Neighbor_Down

R1# show event manager history events

Event History: No. Time Type Name 1 00:01:30 UTC Mar 1 syslog EIGRP_Neighbor_Down

Based on this output, which statement is correct?

Question 18hardmultiple choice

A network engineer runs the following command on Router R1:

R1# show event manager policy registered

No. Type Time Created Name 1 applet 00:01:23 UTC Mar 1 2025 BGP_Neighbor_Down

R1# show bgp neighbors 192.168.1.2

BGP neighbor is 192.168.1.2, remote AS 65002, external link BGP version 4, remote router ID 10.0.0.2 BGP state = Idle Last read 00:00:05, hold time is 180, keepalive interval is 60 seconds

Neighbor sessions:

1 active, is not multisession capable

Based on this output, what is the most likely conclusion?

Question 19mediummultiple choice

Consider the following EEM applet configuration:

!--- event manager applet CHECK_OSPF event syslog pattern "OSPF-5-ADJCHG" action 1.0 cli command "enable" action 2.0 cli command "show ip ospf neighbor" action 3.0 mail server "smtp.example.com" to "admin@example.com" from "router@example.com" subject "OSPF Adjacency Change" body "An OSPF adjacency change has been detected." !---

What is the effect of this configuration?

Question 20mediummultiple choice

Examine the following EEM applet configuration:

!--- event manager applet LOGIN_ALERT event syslog occurs 1 period 60 action 1.0 syslog msg "Login event detected" !---

What is the problem with this configuration?

Question 21mediummultiple choice

Read the full Embedded Event Manager (EEM) explanation →

Consider the following EEM applet configuration:

!--- event manager applet INTERFACE_DOWN event syslog pattern "%LINEPROTO-5-UPDOWN" action 1.0 if $syslog_severity eq 5 action 2.0 cli command "enable" action 3.0 cli command "clear counters" !---

What will happen when a syslog message matching the pattern is generated?

Question 22mediummultiple choice

Examine the following EEM applet configuration:

!--- event manager applet BACKUP_CONFIG event timer watchdog time 86400 action 1.0 cli command "enable" action 2.0 cli command "copy running-config tftp://192.168.1.100/backup.cfg" !---

What is the effect of this configuration?

Question 23mediummultiple choice

Consider the following EEM applet configuration:

!--- event manager applet HIGH_CPU event snmp oid 1.3.6.1.4.1.9.9.109.1.1.1.1.3.1 get-type exact entry-op gt entry-val 90 poll-interval 10 action 1.0 syslog msg "CPU utilization exceeded 90%" !---

What is the problem with this configuration?

Question 24mediummultiple choice

Read the full Embedded Event Manager (EEM) explanation →

Examine the following EEM applet configuration:

!--- event manager applet RELOAD_NOTIFY event syslog pattern "%SYS-5-RELOAD" action 1.0 cli command "enable" action 2.0 cli command "send log "Router is reloading"" !---

What is the effect of this configuration?

Question 25easymultiple choice

What is the default behavior of an EEM applet when a 'set' action modifies a variable that is used in a subsequent 'if' condition?

Question 26easymultiple choice

Read the full Embedded Event Manager (EEM) explanation →

Which of the following EEM event types can be used to trigger an applet based on a specific IOS command being entered?

Question 27easymultiple choice

Read the full Embedded Event Manager (EEM) explanation →

What is the maximum number of actions that can be configured in a single EEM applet?

Question 28mediummulti select

Read the full Embedded Event Manager (EEM) explanation →

Which TWO commands would a network engineer use to verify the operation of an Embedded Event Manager (EEM) applet that triggers on a syslog pattern? (Choose TWO.)

Question 29mediummulti select

Which TWO statements about Embedded Event Manager (EEM) applet configuration are true? (Choose TWO.)

Question 30hardmulti select

Which THREE symptoms indicate that an Embedded Event Manager (EEM) applet configured to send a syslog message upon interface down has failed to execute? (Choose THREE.)

Question 31hardmulti select

Read the full Embedded Event Manager (EEM) explanation →

Which TWO configuration steps are required to enable an Embedded Event Manager (EEM) applet that sends an SNMP trap when a specific OID is polled? (Choose TWO.)

Question 32mediummulti select

Which TWO commands can be used to troubleshoot an Embedded Event Manager (EEM) applet that is not triggering as expected? (Choose TWO.)

Question 33hardmultiple choice

A large enterprise network is experiencing intermittent BGP session resets between R1 and R2. R1 has the following relevant configuration: event manager applet BGP-MONITOR event syslog pattern "%BGP-3-NOTIFICATION" action 1.0 cli command "enable" action 2.0 cli command "clear ip bgp *" action 3.0 syslog msg "BGP session cleared by EEM". Router R2 shows: BGP neighbor 10.1.1.1 has been up for 0:00:05, state Established. What is the root cause?

Question 34hardmultiple choice

Read the full VPN explanation →

A network engineer configures EEM to monitor OSPF neighbor state changes. R1 has: event manager applet OSPF-MON event syslog pattern "%OSPF-5-ADJCHG" action 1.0 cli command "enable" action 2.0 cli command "show ip ospf neighbor" action 3.0 syslog msg "OSPF neighbor change detected". After a link flap, the engineer notices that the EEM applet does not execute. Router R2 shows: OSPF neighbor state changes are logged, but no EEM actions occur. What is the root cause?

Question 35hardmultiple choice

A DMVPN network is experiencing spoke-to-spoke tunnel failures. R1 (hub) has: event manager applet DMVPN-TRIGGER event syslog pattern "%DMVPN-5-UP" action 1.0 cli command "enable" action 2.0 cli command "clear crypto sa" action 3.0 syslog msg "Cleared crypto SAs". Router R2 (spoke) shows: DMVPN tunnel is up, but IPsec SAs are renegotiating frequently. What is the root cause?

Question 36hardmultiple choice

Read the full MPLS explanation →

A network engineer configures EEM to monitor memory usage on R1. R1 has: event manager applet MEM-MONITOR event snmp oid 1.3.6.1.4.1.9.9.48.1.1.1.6.1 get-type exact entry-op gt entry-val 90 poll-interval 10 action 1.0 cli command "enable" action 2.0 cli command "show processes memory" action 3.0 syslog msg "High memory usage detected". After a few days, the engineer notices that the applet never triggers, even though memory usage exceeds 90%. Router R2 shows: memory usage is at 95%, but no syslog from EEM. What is the root cause?

Question 37hardmultiple choice

A service provider network is experiencing MPLS label distribution failures between R1 and R2. R1 has: event manager applet LDP-MONITOR event syslog pattern "%LDP-4-ERROR" action 1.0 cli command "enable" action 2.0 cli command "clear mpls ldp neighbor *" action 3.0 syslog msg "Cleared LDP neighbors". Router R2 shows: LDP session is down, and logs show repeated LDP errors. What is the root cause?

Question 38hardmultiple choice

A network engineer configures EEM to monitor interface state changes on R1. R1 has: event manager applet INT-MONITOR event syslog pattern "%LINEPROTO-5-UPDOWN" action 1.0 cli command "enable" action 2.0 cli command "show ip route" action 3.0 syslog msg "Interface state change detected". After a link flap on interface GigabitEthernet0/1, the engineer notices that the EEM applet runs multiple times, but the show ip route output is incomplete. Router R2 shows: routing table updates are delayed. What is the root cause?

Question 39hardmultiple choice

A network engineer configures EEM to monitor BGP prefix limits on R1. R1 has: event manager applet BGP-PREFIX event syslog pattern "%BGP-3-PREFIX_LIMIT" action 1.0 cli command "enable" action 2.0 cli command "clear ip bgp 10.1.1.2" action 3.0 syslog msg "Cleared BGP session". Router R2 shows: BGP session with R1 is flapping, and logs show repeated prefix limit warnings. What is the root cause?

Question 40hardmultiple choice

A network engineer configures EEM to monitor CPU usage on R1. R1 has: event manager applet CPU-MONITOR event snmp oid 1.3.6.1.4.1.9.9.109.1.1.1.1.7.1 get-type exact entry-op gt entry-val 80 poll-interval 5 action 1.0 cli command "enable" action 2.0 cli command "show processes cpu sorted" action 3.0 syslog msg "High CPU usage detected". After a few hours, the engineer notices that the applet triggers repeatedly, but the show command output is truncated. Router R2 shows: no issues. What is the root cause?

Question 41hardmultiple choice

A network engineer configures EEM to monitor routing table changes on R1. R1 has: event manager applet ROUTE-MONITOR event syslog pattern "%ROUTING-5-ROUTECHANGE" action 1.0 cli command "enable" action 2.0 cli command "show ip route" action 3.0 syslog msg "Routing table changed". After a route update, the engineer notices that the applet runs but the show ip route output does not reflect the change. Router R2 shows: the route is present in the routing table. What is the root cause?

Question 42mediummultiple choice

A network engineer runs the following command to troubleshoot an EEM issue:

R1# show event manager policy registered

No. Class Type Version Time Created Name 1 applet system 1.0 Mar 1 00:00:12 2025 TRACK-INTERFACE 2 applet system 1.0 Mar 1 00:00:15 2025 BGP-RESET 3 applet user 1.0 Mar 1 00:02:30 2025 LOG-ERROR

What does this output indicate?

Question 43mediummultiple choice

Read the full Embedded Event Manager (EEM) explanation →

A network engineer runs the following command to troubleshoot an EEM issue:

R1# show event manager history events

Event History: Event Type : syslog Time : Mar 1 00:05:23 Pattern : OSPF-5-ADJCHG Trigger count : 1

Event Type : timer Time : Mar 1 00:06:00 Timer Type : absolute Timer Name : MY-TIMER Trigger count : 1

What does this output indicate?

Question 44hardmultiple choice

A network engineer runs the following command to troubleshoot an EEM issue:

R1# debug event manager action cli

EEM Action CLI debugging is on

R1#

Mar  1 00:10:15.123: %HA_EM-6-ACTION: applet TRACK-INTERFACE: action cli command: 'show ip int brief' executed
Mar  1 00:10:15.456: %HA_EM-6-ACTION: applet TRACK-INTERFACE: action cli output: 'Interface                  IP-Address      OK? Method Status                Protocol

GigabitEthernet0/0 192.168.1.1 YES NVRAM up up GigabitEthernet0/1 10.0.0.1 YES NVRAM up up Loopback0 1.1.1.1 YES NVRAM up up'

What does this output indicate?

Question 45mediummultiple choice

A network engineer runs the following command to troubleshoot an EEM issue:

R1# show event manager policy active

No. Class Type Version Time Created Name 1 applet system 1.0 Mar 1 00:00:12 2025 TRACK-INTERFACE Event Type: syslog (pattern OSPF-5-ADJCHG) Action: cli command 'show ip route'

What does this output indicate?

Question 46hardmultiple choice

A network engineer runs the following command to troubleshoot an EEM issue:

R1# show event manager environment all

No. Variable Name Value 1 _exit_status 1 2 _event_type syslog 3 _syslog_msg %OSPF-5-ADJCHG: Process 1, Nbr 10.0.0.2 on GigabitEthernet0/0 from LOADING to FULL, Loading Done 4 _syslog_severity 5 5 _syslog_facility OSPF 6 _syslog_mnemonic ADJCHG

What does this output indicate?

Question 47mediummultiple choice

A network engineer runs the following command to troubleshoot an EEM issue:

R1# show event manager history applet TRACK-INTERFACE

Applet TRACK-INTERFACE: Time Created : Mar 1 00:00:12 2025 Time Last Triggered : Mar 1 00:15:30 2025 Time Last Executed : Mar 1 00:15:30 2025 Trigger Count : 5 Execution Count : 5 Last Event Type : syslog Last Event Detail : OSPF-5-ADJCHG Last Action Executed : show ip route Last Action Result : Success

What does this output indicate?

Question 48hardmultiple choice

A network engineer runs the following command to troubleshoot an EEM issue:

R1# show event manager detector

Detector Name : syslog Detector Type : system Detector State : enabled Detector Queue Size : 100 Detector Queue Max : 200 Detector Events Triggered : 15

Detector Name : timer Detector Type : system Detector State : enabled Detector Queue Size : 0 Detector Queue Max : 50 Detector Events Triggered : 3

What does this output indicate?

Question 49mediummultiple choice

A network engineer runs the following command to troubleshoot an EEM issue:

R1# show event manager policy configuration TRACK-INTERFACE

Applet TRACK-INTERFACE event syslog pattern "OSPF-5-ADJCHG" action 1.0 cli command "show ip route" action 2.0 cli command "show ip ospf neighbor" action 3.0 syslog msg "OSPF adjacency change detected"

What does this output indicate?

Question 50mediummultiple choice

Read the full Embedded Event Manager (EEM) explanation →

A network engineer runs the following command to troubleshoot an EEM issue:

R1# debug event manager action syslog

EEM Action Syslog debugging is on

R1#

Mar  1 00:20:45.789: %HA_EM-6-ACTION: applet TRACK-INTERFACE: action syslog msg: 'OSPF adjacency change detected'

What does this output indicate?

Question 51easymultiple choice

Which statement correctly describes the default behavior of the Embedded Event Manager (EEM) when an event occurs and no action is explicitly defined?

Question 52mediummultiple choice

Read the full Embedded Event Manager (EEM) explanation →

What is the default timer value for the EEM environment variable 'timer watchdog'?

Question 53mediummultiple choice

Read the full Embedded Event Manager (EEM) explanation →

Which EEM event type uses a default polling interval of 60 seconds when no interval is explicitly configured?

Question 54hardmultiple choice

Read the full Embedded Event Manager (EEM) explanation →

What is the default behavior of EEM when multiple policies are registered for the same event?

Question 55hardmultiple choice

Read the full Embedded Event Manager (EEM) explanation →

Which statement correctly describes the default authentication behavior for EEM policy files stored in flash?

Question 56hardmultiple choice

Read the full Embedded Event Manager (EEM) explanation →

What is the default maximum recursion depth for EEM Tcl policies?

Question 57easymultiple choice

Read the full Embedded Event Manager (EEM) explanation →

Which EEM action type is used to modify the configuration of the device?

Question 58mediummultiple choice

Read the full Embedded Event Manager (EEM) explanation →

What is the default behavior of EEM when a policy encounters a runtime error?

Question 59hardmultiple choice

Read the full Embedded Event Manager (EEM) explanation →

Which statement correctly describes the default value of the 'event timer countdown' when no countdown time is specified?

Question 60mediumdrag order

Read the full Embedded Event Manager (EEM) explanation →

Drag and drop the steps to create and register an EEM applet for syslog events into the correct order, from first to last.

Question 61harddrag order

Drag and drop the steps to troubleshoot EEM adjacency or connectivity failures into the correct order, from first to last.

Question 62mediumdrag order

Read the full Embedded Event Manager (EEM) explanation →

Drag and drop the steps to verify and validate EEM operational state into the correct order, from first to last.

Question 63hardmulti select

Read the full Embedded Event Manager (EEM) explanation →

Which TWO statements about EEM applet configuration and execution are correct? (Choose TWO.)

Question 64hardmulti select

Read the full Embedded Event Manager (EEM) explanation →

Which TWO statements about EEM environment variables and their scoping are true? (Choose TWO.)

Question 65hardmulti select

Read the full Embedded Event Manager (EEM) explanation →

An engineer wants to use EEM to automatically back up the running configuration to a TFTP server whenever a 'write memory' command is executed. Which TWO configuration steps are required? (Choose TWO.)

Question 66hardmulti select

Read the full Embedded Event Manager (EEM) explanation →

Which TWO statements about EEM applet debugging and verification are correct? (Choose TWO.)

Question 67hardmulti select

Read the full Embedded Event Manager (EEM) explanation →

Which TWO statements about EEM applet actions and their behavior are correct? (Choose TWO.)

Question 68hardmultiple choice

Study the full EIGRP explanation →

An engineer configures an EEM applet to monitor OSPF neighbor state changes using the event syslog pattern 'OSPF-5-ADJCHG'. The applet triggers a custom syslog message. The OSPF adjacency between two routers fails due to an MTU mismatch, but the EEM applet does not trigger. Which is the most likely explanation?

Question 69hardmultiple choice

A network engineer configures an EEM applet to monitor EIGRP stuck-in-active (SIA) events using the event syslog pattern 'EIGRP-3-SIA'. The applet is designed to clear the EIGRP neighbor. The EIGRP network has a unidirectional link that causes a route to go active, but the EEM applet does not trigger. Which is the most likely explanation?

Question 70hardmultiple choice

An engineer configures an EEM applet to react to BGP prefix changes using the event syslog pattern 'BGP-5-ADJCHANGE'. The applet sends a custom SNMP trap. The BGP session between two routers is established, but when a route is withdrawn due to next-hop-self requirement for iBGP, the EEM applet does not trigger. Which is the most likely explanation?

Question 71hardmultiple choice

Read the full VPN explanation →

A network engineer configures an EEM applet to monitor redistribution events using the event syslog pattern 'IP-4-ROUTING'. The applet is intended to log when a route is redistributed from OSPF into EIGRP. The redistribution is configured without a seed metric for EIGRP, and the route is not redistributed. The EEM applet does not trigger. Which is the most likely explanation?

Question 72hardmultiple choice

An engineer configures an EEM applet to monitor DMVPN tunnel events using the event syslog pattern 'NHRP-3-REGISTRATION'. The applet is supposed to send an email when a spoke registers with the NHS. The DMVPN network uses Phase 2 with spoke-to-spoke tunnels. A spoke registers successfully, but the EEM applet does not trigger. Which is the most likely explanation?

Question 73hardmultiple choice

Read the full VPN explanation →

A network engineer configures an EEM applet to monitor IPsec tunnel failures using the event syslog pattern 'IPSEC-3-IPSEC'. The applet is designed to clear the IPsec security associations. The IPsec tunnel fails due to a transform-set mismatch, but the EEM applet does not trigger. Which is the most likely explanation?

Question 74hardmultiple choice

Study the full ACL explanation →

An engineer configures an EEM applet to monitor CoPP (Control Plane Policing) drops using the event syslog pattern 'COPP-3-DROP'. The applet is intended to log when CoPP drops packets. The CoPP policy is applied with a rate-limit in bps, but the traffic exceeds the rate, and packets are dropped. The EEM applet does not trigger. Which is the most likely explanation?

Question 75hardmultiple choice

A network engineer configures an EEM applet to monitor uRPF (Unicast Reverse Path Forwarding) failures using the event syslog pattern 'IP-3-URPF'. The applet is designed to log when uRPF drops packets due to strict mode. The network has asymmetric routing, and packets are dropped. The EEM applet does not trigger. Which is the most likely explanation?

Question 76hardmultiple choice