300-410 Embedded Event Manager (EEM) Practice Test 2 — 15 Questions

Question 1

A network engineer runs the following command on Router R1:

R1# show event manager history events

Event History:
No.  Time                Type                Name
1    00:01:30 UTC Mar 1  syslog              OSPF_Neighbor_Down
2    00:01:31 UTC Mar 1  syslog              OSPF_Neighbor_Up
3    00:01:32 UTC Mar 1  syslog              OSPF_Neighbor_Down
4    00:01:33 UTC Mar 1  syslog              OSPF_Neighbor_Up

Based on this output, which statement is correct?

Accepted Answer

The OSPF neighbor is flapping.. The event history shows alternating OSPF neighbor down and up events within seconds, indicating a flapping condition. The correct answer is that the OSPF neighbor is flapping.

Answer

The OSPF neighbor is stable.

Answer

The EEM policy is not configured.

Answer

The OSPF neighbor is down permanently.

Question 2

A network engineer runs the following command on Router R1:

R1# show event manager policy registered

No.  Type    Time Created            Name
1    applet  00:01:23 UTC Mar 1 2025  EIGRP_Neighbor_Down

R1# show event manager history events

Event History:
No.  Time                Type                Name
1    00:01:30 UTC Mar 1  syslog              EIGRP_Neighbor_Down

Based on this output, which statement is correct?

Accepted Answer

The EIGRP neighbor down event has occurred once.. The output shows one registered EEM applet policy and one triggered event. The correct answer is that the EIGRP neighbor down event has occurred once.

Answer

The EIGRP neighbor is currently down.

Answer

The EEM policy is disabled.

Answer

The EIGRP neighbor is flapping.

Question 3

A network engineer runs the following command on Router R1:

R1# show event manager policy registered

No.  Type    Time Created            Name
1    applet  00:01:23 UTC Mar 1 2025  BGP_Neighbor_Down

R1# show bgp neighbors 192.168.1.2

BGP neighbor is 192.168.1.2,  remote AS 65002, external link
  BGP version 4, remote router ID 10.0.0.2
  BGP state = Idle
  Last read 00:00:05, hold time is 180, keepalive interval is 60 seconds
  Neighbor sessions:
    1 active, is not multisession capable

Based on this output, what is the most likely conclusion?

Accepted Answer

The BGP neighbor is down, and the EEM policy may have been triggered.. The EEM policy BGP_Neighbor_Down is registered, and the BGP neighbor is in Idle state, indicating the session is down. The correct answer is that the BGP neighbor is down, and the EEM policy may have been triggered.

Answer

The BGP neighbor is up and running.

Answer

The EEM policy is not registered.

Answer

The BGP session is established.

Question 4

Consider the following EEM applet configuration:

!---
event manager applet CHECK_OSPF
event syslog pattern "OSPF-5-ADJCHG"
action 1.0 cli command "enable"
action 2.0 cli command "show ip ospf neighbor"
action 3.0 mail server "smtp.example.com" to "admin@example.com" from "router@example.com" subject "OSPF Adjacency Change" body "An OSPF adjacency change has been detected."
!---

What is the effect of this configuration?

Accepted Answer

The applet will send an email to the administrator whenever an OSPF adjacency change occurs.. The EEM applet triggers on a syslog message matching the pattern "OSPF-5-ADJCHG". When triggered, it sends an email notification to the administrator. The 'cli command' actions are executed but their output is not used; the email is sent regardless. The applet does not require any additional configuration to send the email, provided the mail server is reachable.

Answer

The applet will only execute the CLI commands and will not send an email because the mail server is not configured globally.

Answer

The applet will fail because the 'event syslog pattern' must be configured with a regular expression.

Answer

The applet will send the email only after the CLI commands complete, but the output of those commands is not included in the email.

Question 5

Examine the following EEM applet configuration:

!---
event manager applet LOGIN_ALERT
event syslog occurs 1 period 60
action 1.0 syslog msg "Login event detected"
!---

What is the problem with this configuration?

Accepted Answer

The 'event syslog occurs' command is missing the required 'pattern' keyword.. The 'event syslog occurs' command requires a pattern to match against syslog messages. Without a pattern, the applet will never trigger because the event is not properly defined. The correct syntax is 'event syslog pattern occurs period '.

Answer

The period of 60 seconds is too short and will cause high CPU usage.

Answer

The 'syslog msg' action cannot be used in the same applet as 'event syslog occurs'.

Answer

The applet will trigger on every syslog message, which is not the intended behavior.

Question 6

Consider the following EEM applet configuration:

!---
event manager applet INTERFACE_DOWN
event syslog pattern "%LINEPROTO-5-UPDOWN"
action 1.0 if $syslog_severity eq 5
action 2.0 cli command "enable"
action 3.0 cli command "clear counters"
!---

What will happen when a syslog message matching the pattern is generated?

Accepted Answer

The applet will execute the CLI commands unconditionally because the 'if' action is misconfigured.. The applet uses an 'if' action to check the syslog severity. If the severity is 5 (notification), the CLI commands are executed. However, the 'if' action is not closed with an 'end' statement, which is required. As a result, the applet will encounter a syntax error and may not execute correctly, or the CLI commands may be executed unconditionally depending on the IOS version.

Answer

The applet will execute the CLI commands only if the syslog severity is exactly 5.

Answer

The applet will fail to register because the 'if' action requires an 'else' clause.

Answer

The applet will clear the counters only for the interface that generated the syslog message.

Question 7

Examine the following EEM applet configuration:

!---
event manager applet BACKUP_CONFIG
event timer watchdog time 86400
action 1.0 cli command "enable"
action 2.0 cli command "copy running-config tftp://192.168.1.100/backup.cfg"
!---

What is the effect of this configuration?

Accepted Answer

The applet will copy the running configuration to the TFTP server every 24 hours.. The applet uses a watchdog timer event that triggers every 86400 seconds (24 hours). When triggered, it copies the running configuration to a TFTP server. This is a valid configuration for periodic backup.

Answer

The applet will copy the startup configuration instead of the running configuration.

Answer

The applet will fail because the TFTP server IP address is not reachable.

Answer

The applet will only trigger once because the watchdog timer is a one-shot timer.

Question 8

Consider the following EEM applet configuration:

!---
event manager applet HIGH_CPU
event snmp oid 1.3.6.1.4.1.9.9.109.1.1.1.1.3.1 get-type exact entry-op gt entry-val 90 poll-interval 10
action 1.0 syslog msg "CPU utilization exceeded 90%"
!---

What is the problem with this configuration?

Accepted Answer

The OID is a scalar, so 'entry-op' and 'entry-val' cannot be used; they are only for table entries.. The 'event snmp oid' command requires a 'get-type' of 'exact' or 'next', but the OID specified is for a specific instance (cpmCPUTotal5sec). However, the OID is not complete; it should include the instance index. Additionally, the 'entry-op' and 'entry-val' are used for table entries, but this OID is a scalar. The correct approach is to use 'event snmp oid' with a scalar OID and use 'poll-interval' with 'entry-op' and 'entry-val' only for table entries. This configuration may cause the applet to not trigger correctly.

Answer

The 'poll-interval' is too short and will cause high CPU usage.

Answer

The applet will work correctly and generate a syslog message when CPU exceeds 90%.

Answer

The 'get-type exact' is incorrect; it should be 'get-type next'.

Question 9

Examine the following EEM applet configuration:

!---
event manager applet RELOAD_NOTIFY
event syslog pattern "%SYS-5-RELOAD"
action 1.0 cli command "enable"
action 2.0 cli command "send log "Router is reloading""
!---

What is the effect of this configuration?

Accepted Answer

The applet will fail because 'send log' is not a valid IOS command.. The applet triggers on a syslog message indicating a reload. It then executes a 'send log' command, which is not a valid IOS command. The correct command is 'send log' is not valid; the intended command might be 'send' or 'logger'. This will cause the action to fail, and the applet will not execute successfully.

Answer

The applet will send a log message to the console when a reload is initiated.

Answer

The applet will prevent the reload from occurring.

Answer

The applet will generate a syslog message with the text "Router is reloading".

Question 10

What is the default behavior of an EEM applet when a 'set' action modifies a variable that is used in a subsequent 'if' condition?

Accepted Answer

The variable is evaluated at the time the 'if' condition is executed, so it uses the updated value.. EEM applets execute actions sequentially. If a 'set' action modifies a variable, that new value is used in any subsequent 'if' condition that references the same variable. Variables are not pre-evaluated; they are evaluated at the time the action is executed.

Answer

The variable is evaluated at the start of the applet, so the 'if' condition uses the original value.

Answer

The 'set' action cannot modify a variable that is used in an 'if' condition.

Answer

The applet will fail if a variable is modified after being used in an 'if' condition.

Question 11

Which of the following EEM event types can be used to trigger an applet based on a specific IOS command being entered?

Accepted Answer

event cli. EEM provides the 'event cli' event type to match on CLI commands. The syntax is 'event cli pattern <string>' where the pattern can be a regular expression to match the command. Other event types like 'event syslog' match syslog messages, not CLI commands.

Answer

event syslog

Answer

event snmp

Answer

event timer

Question 12

What is the maximum number of actions that can be configured in a single EEM applet?

Accepted Answer

255. The maximum number of actions in an EEM applet is 255. This is a hard limit in Cisco IOS. If more actions are needed, multiple applets must be used.

Answer

128

Answer

512

Answer

Unlimited

Question 13

Which TWO commands would a network engineer use to verify the operation of an Embedded Event Manager (EEM) applet that triggers on a syslog pattern? (Choose TWO.)

Accepted Answer

show event manager history events. The 'show event manager history events' command displays recent EEM events, including those triggered by syslog patterns, while 'show event manager policy active' lists currently registered and active EEM applets. The other options either show unrelated EEM data or require additional configuration to be useful.

Answer

show event manager detector syslog

Answer

show event manager environment

Answer

debug event manager action all

Question 14

Which TWO statements about Embedded Event Manager (EEM) applet configuration are true? (Choose TWO.)

Accepted Answer

An EEM applet can be configured with multiple event statements using the 'event' command with the 'or' operator.. EEM applets can use multiple event statements combined with a Boolean operator, and the 'action' command supports Cisco IOS CLI commands via the 'cli' keyword. The other statements are false: applets do not require a Tcl script, multiple actions are allowed, and the 'event none' option is valid for manual triggering.

Answer

An EEM applet must include a Tcl script to perform any actions.

Answer

An EEM applet can only have a single action command.

Answer

The 'event none' configuration is not allowed in an EEM applet.

Question 15

Which THREE symptoms indicate that an Embedded Event Manager (EEM) applet configured to send a syslog message upon interface down has failed to execute? (Choose THREE.)

Accepted Answer

No custom syslog message appears on the console or in the log buffer when the interface goes down.. If the applet fails, no custom syslog is generated, the 'show event manager history events' will not show the trigger, and the 'show event manager policy active' may show the policy but with a non-zero failure count. The other options either describe normal behavior or unrelated issues.

Answer

The interface goes down and the router generates a default syslog message like '%LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to down'.

Answer

The 'show event manager environment' output shows the variable '_event_type' as 'none'.