300-410 Embedded Event Manager (EEM) Practice Test 4 — 15 Questions

Question 1

A network engineer runs the following command to troubleshoot an EEM issue:

R1# show event manager environment all

No.  Variable Name                          Value
  1  _exit_status                           1
  2  _event_type                            syslog
  3  _syslog_msg                            %OSPF-5-ADJCHG: Process 1, Nbr 10.0.0.2 on GigabitEthernet0/0 from LOADING to FULL, Loading Done
  4  _syslog_severity                       5
  5  _syslog_facility                       OSPF
  6  _syslog_mnemonic                       ADJCHG

What does this output indicate?

Accepted Answer

The environment variables show that a syslog event with mnemonic ADJCHG triggered, and the applet can use these variables in actions.. The output shows the EEM environment variables that are set when an event triggers an applet. These variables contain information about the event, such as the event type, syslog message details, and exit status. This is useful for debugging applets that use these variables in their actions.

Answer

The environment variables are configured manually by the engineer to define the applet behavior.

Answer

The output shows the current state of all EEM applets and their variables.

Answer

The _exit_status variable indicates the applet failed to execute.

Question 2

A network engineer runs the following command to troubleshoot an EEM issue:

R1# show event manager history applet TRACK-INTERFACE

Applet TRACK-INTERFACE:
  Time Created : Mar 1 00:00:12 2025
  Time Last Triggered : Mar 1 00:15:30 2025
  Time Last Executed : Mar 1 00:15:30 2025
  Trigger Count : 5
  Execution Count : 5
  Last Event Type : syslog
  Last Event Detail : OSPF-5-ADJCHG
  Last Action Executed : show ip route
  Last Action Result : Success

What does this output indicate?

Accepted Answer

The applet 'TRACK-INTERFACE' has been triggered 5 times and executed successfully each time, with the last trigger at 00:15:30.. The output shows the history for a specific EEM applet. It includes creation time, last trigger and execution times, trigger and execution counts, the last event that triggered it, the last action executed, and the result. This helps in determining if the applet is being triggered and executing successfully.

Answer

The applet 'TRACK-INTERFACE' has failed to execute 5 times.

Answer

The applet 'TRACK-INTERFACE' has not been triggered since it was created.

Answer

The applet 'TRACK-INTERFACE' executed the action 'show ip route' but the output was not captured.

Question 3

A network engineer runs the following command to troubleshoot an EEM issue:

R1# show event manager detector

Detector Name : syslog
  Detector Type : system
  Detector State : enabled
  Detector Queue Size : 100
  Detector Queue Max : 200
  Detector Events Triggered : 15

Detector Name : timer
  Detector Type : system
  Detector State : enabled
  Detector Queue Size : 0
  Detector Queue Max : 50
  Detector Events Triggered : 3

What does this output indicate?

Accepted Answer

Both syslog and timer detectors are enabled. The syslog detector has triggered 15 events and has 100 events in its queue.. The output shows the status of EEM detectors. Detectors are components that monitor for specific events (syslog, timer, etc.). The output shows each detector's state (enabled/disabled), queue size and maximum, and the number of events triggered. Queue size indicates pending events waiting to be processed.

Answer

The syslog detector is disabled and needs to be enabled for EEM to work.

Answer

The timer detector has triggered 3 events and has 50 events in its queue.

Answer

The queue size of 100 for syslog indicates that 100 events have been dropped.

Question 4

A network engineer runs the following command to troubleshoot an EEM issue:

R1# show event manager policy configuration TRACK-INTERFACE

Applet TRACK-INTERFACE
  event syslog pattern "OSPF-5-ADJCHG"
  action 1.0 cli command "show ip route"
  action 2.0 cli command "show ip ospf neighbor"
  action 3.0 syslog msg "OSPF adjacency change detected"

What does this output indicate?

Accepted Answer

The applet 'TRACK-INTERFACE' is configured to trigger on syslog message 'OSPF-5-ADJCHG' and execute three actions in order: show ip route, show ip ospf neighbor, and send a syslog message.. The output shows the configuration of a specific EEM applet. It displays the event trigger and the actions in order. Each action has a step number (e.g., 1.0) that determines the order of execution. This is useful for verifying the applet configuration.

Answer

The applet 'TRACK-INTERFACE' is currently executing and has run the first two actions.

Answer

The applet 'TRACK-INTERFACE' has a syntax error because the actions are not numbered correctly.

Answer

The applet 'TRACK-INTERFACE' will only execute the first action because the others are commented out.

Question 5

A network engineer runs the following command to troubleshoot an EEM issue:

R1# debug event manager action syslog

EEM Action Syslog debugging is on

R1#
Mar  1 00:20:45.789: %HA_EM-6-ACTION: applet TRACK-INTERFACE: action syslog msg: 'OSPF adjacency change detected'

What does this output indicate?

Accepted Answer

The EEM applet 'TRACK-INTERFACE' executed a syslog action and generated the message 'OSPF adjacency change detected'.. The debug output shows the execution of syslog actions within an EEM applet. It displays the applet name and the syslog message being generated. This is useful for verifying that syslog actions are working correctly.

Answer

The EEM applet 'TRACK-INTERFACE' received a syslog message 'OSPF adjacency change detected'.

Answer

The debug output shows the configuration of the syslog action for applet 'TRACK-INTERFACE'.

Answer

The syslog message was generated by the system, not by the EEM applet.

Question 6

Which statement correctly describes the default behavior of the Embedded Event Manager (EEM) when an event occurs and no action is explicitly defined?

Accepted Answer

EEM will take no action and the event is silently ignored.. By default, EEM does not perform any action if none is configured; it simply logs the event occurrence.

Answer

EEM will generate a syslog message by default.

Answer

EEM will execute the default action of reloading the device.

Answer

EEM will send an SNMP trap by default.

Question 7

What is the default timer value for the EEM environment variable 'timer watchdog'?

Accepted Answer

60 seconds. The default watchdog timer is 60 seconds; it monitors the EEM policy execution and resets if exceeded.

Answer

30 seconds

Answer

120 seconds

Answer

180 seconds

Question 8

Which EEM event type uses a default polling interval of 60 seconds when no interval is explicitly configured?

Accepted Answer

event snmp. The 'event snmp' type polls at a default interval of 60 seconds if the 'interval' keyword is omitted.

Answer

event syslog

Answer

event timer

Answer

event cli

Question 9

What is the default behavior of EEM when multiple policies are registered for the same event?

Accepted Answer

Policies run in order of priority (lower number = higher priority), then alphabetically by name.. EEM policies are executed in order of their priority; if priorities are equal, the policy with the lowest name (alphanumeric) runs first.

Answer

All policies run simultaneously in parallel.

Answer

Only the first registered policy runs.

Answer

Policies run in reverse order of registration.

Question 10

Which statement correctly describes the default authentication behavior for EEM policy files stored in flash?

Accepted Answer

EEM does not perform any authentication or integrity check on policy files by default.. EEM does not enforce any authentication by default; policy files are executed as-is without integrity checks.

Answer

EEM requires all policy files to be signed with a digital certificate.

Answer

EEM uses MD5 hash verification by default.

Answer

EEM uses the device's AAA configuration to authenticate policy execution.

Question 11

What is the default maximum recursion depth for EEM Tcl policies?

Accepted Answer

100. EEM limits Tcl policy recursion to 100 levels by default to prevent infinite loops.

Answer

10

Answer

50

Answer

Unlimited

Question 12

Which EEM action type is used to modify the configuration of the device?

Accepted Answer

action cli. The 'action cli' command allows executing Cisco IOS commands, including configuration changes.

Answer

action syslog

Answer

action snmp-trap

Answer

action mail

Question 13

What is the default behavior of EEM when a policy encounters a runtime error?

Accepted Answer

EEM logs the error and continues with the next policy.. By default, EEM logs the error via syslog and stops executing the policy; it does not retry.

Answer

EEM automatically retries the policy up to three times.

Answer

EEM reloads the device to clear the error.

Answer

EEM ignores the error and proceeds with the next action in the same policy.

Question 14

Which statement correctly describes the default value of the 'event timer countdown' when no countdown time is specified?

Accepted Answer

There is no default; a countdown time must be explicitly configured.. The 'event timer countdown' requires an explicit time value; there is no default — the configuration will be rejected if omitted.

Answer

The default countdown time is 60 seconds.

Answer

The default countdown time is 0 seconds, causing immediate trigger.

Answer

The default countdown time is 10 seconds.

Question 15

Drag and drop the steps to create and register an EEM applet for syslog events into the correct order, from first to last.

Accepted Answer

Enter global configuration mode. The correct order begins with entering global configuration mode, then defining the EEM applet and its syslog trigger, followed by configuring the action to execute, and finally exiting configuration mode to register the applet.