300-410 Embedded Event Manager (EEM) — Timed 30 Questions

Question 1

A network engineer is troubleshooting an intermittent BGP session failure between two routers. The BGP session drops every few hours and recovers after a few seconds. The engineer checks the logs and sees that an EEM applet is triggered just before each failure. The applet is configured to run a script that clears the BGP session when a specific syslog message is generated. What is the most likely cause of the BGP session failure?

Accepted Answer

The EEM applet is clearing the BGP session as part of its configured action.. The EEM applet is the root cause because it is configured to clear the BGP session upon a specific syslog event. The engineer should review the applet's trigger condition and action to identify why it is being triggered incorrectly or unnecessarily.

Answer

The BGP session is failing due to a physical layer issue.

Answer

The BGP session is failing due to a routing loop.

Answer

The EEM applet is causing a memory leak that crashes the BGP process.

Question 2

A network engineer notices that a router is sending SNMP traps for interface state changes even when there is no actual interface flapping. The engineer checks the running configuration and finds an EEM applet that monitors interface state changes and sends a syslog message. The applet is configured with a trigger condition that matches any interface state change. What should the engineer do to resolve the issue?

Accepted Answer

Modify the EEM applet trigger to match only the specific interfaces of interest.. The EEM applet is too broadly triggered, causing unnecessary syslog messages that may be interpreted as traps. The engineer should narrow the trigger condition to match only specific interfaces or use a more specific event filter.

Answer

Remove the EEM applet entirely.

Answer

Increase the debounce timer on the interface to reduce flapping.

Answer

Disable SNMP traps for interface state changes.

Question 3

A network engineer is troubleshooting a router that fails to apply a specific configuration change after a reload. The engineer has an EEM applet that runs at boot time to apply a set of commands. After a reload, the engineer checks the configuration and finds that the commands were not applied. The applet is configured with event syslog pattern 'SYS-5-RESTART' and action cli command 'configure terminal'. What is the most likely cause of the failure?

Accepted Answer

The EEM applet runs before the router is fully booted, so the CLI commands fail.. The EEM applet uses the wrong event trigger. The 'SYS-5-RESTART' syslog message may not be generated or may be generated too early before the router is fully ready for configuration commands. The engineer should use 'event none' with a manual trigger or use 'event timer' to delay execution.

Answer

The EEM applet is not enabled globally.

Answer

The syslog pattern 'SYS-5-RESTART' is misspelled.

Answer

The EEM applet requires a 'event manager directory user' command to be configured.

Question 4

A network engineer is troubleshooting a router that is experiencing high CPU utilization. The engineer checks the process list and sees that the 'EEM Server' process is consuming a significant amount of CPU. The engineer reviews the EEM configuration and finds multiple applets that are triggered by syslog events. What should the engineer do first to reduce CPU utilization?

Accepted Answer

Use the 'show event manager statistics' command to see which applets are triggered most often.. High CPU from EEM is often due to excessive syslog triggers. The engineer should first identify which applets are being triggered most frequently and either optimize their conditions or reduce the number of applets.

Answer

Disable all EEM applets.

Answer

Increase the router's CPU priority for the EEM process.

Answer

Change the syslog trigger to use a less frequent pattern.

Question 5

A network engineer is troubleshooting a router that is not sending SNMP traps for a specific interface down event. The engineer has an EEM applet configured to send an SNMP trap when the interface goes down. The applet uses event syslog pattern 'LINK-3-UPDOWN' and action snmp-trap. The interface goes down, but no trap is sent. What is the most likely cause?

Accepted Answer

The SNMP trap destination is not configured globally.. The EEM applet is triggered by a syslog message, but the syslog message may not be generated for that specific interface, or the SNMP trap action may require additional configuration such as an SNMP community or target host.

Answer

The syslog pattern 'LINK-3-UPDOWN' is incorrect; the correct pattern is 'LINK-5-CHANGED'.

Answer

The EEM applet is not registered with the SNMP agent.

Answer

The SNMP trap action requires an SNMP community string to be specified in the applet.

Question 6

A network engineer is troubleshooting a router that is not executing an EEM applet that is supposed to run when a specific interface goes down. The applet is configured with event syslog pattern 'LINK-3-UPDOWN' and matches the interface with a regex. The engineer checks the syslog and sees the message 'LINK-3-UPDOWN: GigabitEthernet0/1, changed state to down' but the applet does not run. What is the most likely cause?

Accepted Answer

The regex pattern in the applet does not match the syslog message.. The EEM applet may have a regex that does not match the actual syslog message format. The engineer should verify the regex pattern using 'show event manager policy' or test the pattern.

Answer

The EEM applet is disabled.

Answer

The syslog message is not being sent to the EEM server due to logging level restrictions.

Answer

The interface is not being monitored because it is a subinterface.

Question 7

A network engineer is troubleshooting a router that is sending duplicate SNMP traps for interface state changes. The engineer finds two EEM applets that both trigger on the same syslog pattern 'LINK-3-UPDOWN' and both send SNMP traps. What should the engineer do to resolve the duplicate traps?

Accepted Answer

Remove one of the duplicate EEM applets.. The duplicate traps are caused by two applets performing the same action. The engineer should remove one of the applets or combine them into one.

Answer

Disable syslog logging for interface state changes.

Answer

Change the SNMP trap destination to a different host for one applet.

Answer

Increase the SNMP trap queue size.

Question 8

A network engineer is troubleshooting a router that is not generating any EEM applet actions even though the applets are configured and enabled. The engineer checks the 'show event manager status' command and sees that the EEM server is running. The engineer also checks the syslog and sees that the trigger events are occurring. What is the most likely cause?

Accepted Answer

The EEM applets are not registered due to a syntax error in the configuration.. Even if the EEM server is running, the applets may not be registered if they have syntax errors or if the 'event manager applet' command is missing. The engineer should use 'show event manager policy available' or 'show event manager policy registered' to verify if the applets are registered.

Answer

The EEM server is not listening for syslog events.

Answer

The router's logging level is set to emergencies only.

Answer

The EEM applets are configured with 'event none' and need manual triggering.

Question 9

A network engineer is troubleshooting a router that is experiencing intermittent packet loss. The engineer checks the logs and sees that an EEM applet is being triggered frequently. The applet is configured to run a script that modifies the routing table. The engineer suspects the applet is causing the packet loss. What should the engineer do to verify the root cause?

Accepted Answer

Temporarily disable the EEM applet and monitor the packet loss.. To verify if the EEM applet is causing the packet loss, the engineer should temporarily disable the applet and monitor the network for any improvement in packet loss.

Answer

Check the EEM applet's script for errors.

Answer

Use the 'show event manager statistics' command to see how often the applet is triggered.

Answer

Increase the logging level to debug to see more details.

Question 10

A network engineer runs the following command on Router R1:

R1# show event manager policy registered

No.  Type    Time Created            Name
1    applet  00:01:23 UTC Mar 1 2025  EIGRP_Neighbor_Down
2    applet  00:01:23 UTC Mar 1 2025  OSPF_Neighbor_Flap

Based on this output, which statement is correct?

Accepted Answer

Two EEM applet policies are registered and active.. The 'show event manager policy registered' command lists all EEM policies registered on the device. The output shows two applet policies registered, but no trigger events are shown. The correct answer is that two EEM applet policies are registered, but the output does not indicate whether they are enabled or disabled; registration means they are loaded and ready to trigger.

Answer

Two EEM applet policies are registered but disabled.

Answer

Only one EEM applet policy is registered.

Answer

The EEM applet policies are triggered by syslog events.

Question 11

A network engineer runs the following command on Router R1:

R1# show event manager history events

Event History:
No.  Time                Type                Name
1    00:01:30 UTC Mar 1  syslog              EIGRP_Neighbor_Down
2    00:01:31 UTC Mar 1  syslog              OSPF_Neighbor_Flap
3    00:01:32 UTC Mar 1  syslog              EIGRP_Neighbor_Down
4    00:01:33 UTC Mar 1  syslog              OSPF_Neighbor_Flap

Based on this output, what is the most likely problem?

Accepted Answer

The router is experiencing network instability causing repeated neighbor state changes.. The 'show event manager history events' command shows the last triggered events. The output shows repeated syslog events for EIGRP neighbor down and OSPF neighbor flap within a short timeframe, indicating a flapping condition. The correct answer is that the router is experiencing network instability causing repeated neighbor state changes.

Answer

The EEM policies are not configured correctly.

Answer

The EEM applet policies are disabled.

Answer

The syslog server is not reachable.

Question 12

A network engineer runs the following command on Router R1:

R1# show event manager policy registered

No.  Type    Time Created            Name
1    applet  00:01:23 UTC Mar 1 2025  BGP_Session_Reset

R1# show event manager history events

Event History:
No.  Time                Type                Name
1    00:02:00 UTC Mar 1  syslog              BGP_Session_Reset
2    00:02:05 UTC Mar 1  syslog              BGP_Session_Reset
3    00:02:10 UTC Mar 1  syslog              BGP_Session_Reset

Based on this output, which statement is correct?

Accepted Answer

The BGP session reset event has occurred three times.. The output shows one registered EEM applet policy named BGP_Session_Reset, and three triggered syslog events for that policy. The correct answer is that the BGP session reset event has occurred multiple times, indicating a persistent issue.

Answer

The EEM policy is not triggering any events.

Answer

The BGP session is stable.

Answer

The EEM policy is disabled.

Question 13

A network engineer runs the following command on Router R1:

R1# show event manager policy registered

No.  Type    Time Created            Name
1    applet  00:01:23 UTC Mar 1 2025  OSPF_Neighbor_Down

R1# show ip ospf neighbor

Neighbor ID     Pri   State           Dead Time   Address         Interface
10.1.1.2         1   FULL/DR         00:00:36    192.168.1.2     GigabitEthernet0/0

Based on this output, what is the most likely conclusion?

Accepted Answer

The EEM policy is registered but not yet triggered because the OSPF neighbor is up.. The EEM policy OSPF_Neighbor_Down is registered, but the OSPF neighbor is in FULL state. The correct answer is that the EEM policy has not been triggered because the OSPF neighbor is up.

Answer

The OSPF neighbor is down.

Answer

The EEM policy has been triggered.

Answer

The EEM policy is misconfigured.

Question 14

A network engineer runs the following command on Router R1:

R1# show event manager policy registered

No.  Type    Time Created            Name
1    applet  00:01:23 UTC Mar 1 2025  BGP_Neighbor_Down

R1# show bgp summary

BGP router identifier 10.0.0.1, local AS number 65001
BGP table version is 1, main routing table version 1
Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
192.168.1.2     4        65002       5       5        1    0    0 00:02:00 Established

Based on this output, which statement is correct?

Accepted Answer

The BGP neighbor is up and the EEM policy has not been triggered.. The EEM policy BGP_Neighbor_Down is registered, but the BGP neighbor is in Established state. The correct answer is that the BGP neighbor is up and the EEM policy has not been triggered.

Answer

The BGP neighbor is down.

Answer

The EEM policy has been triggered.

Answer

The EEM policy is disabled.

Question 15

A network engineer runs the following command on Router R1:

R1# show event manager policy registered

No.  Type    Time Created            Name
1    applet  00:01:23 UTC Mar 1 2025  EIGRP_Neighbor_Down

R1# show ip eigrp neighbors

IP-EIGRP neighbors for process 100
H   Address                 Interface       Hold Uptime   SRTT   RTO  Q  Seq
                                            (sec)         (ms)       Cnt Num
0   192.168.1.2             Gi0/0            13 00:02:00   40   200  0  5

Based on this output, what is the most likely problem?

Accepted Answer

The EIGRP neighbor is up, and the EEM policy is ready to trigger if it goes down.. The EEM policy EIGRP_Neighbor_Down is registered, but the EIGRP neighbor is present with an uptime of 2 minutes. The correct answer is that the EEM policy has not been triggered because the neighbor is up; however, the policy is ready to act if the neighbor goes down.

Answer

The EIGRP neighbor is down.

Answer

The EEM policy has been triggered.

Answer

The EEM policy is misconfigured.

Question 16

A network engineer runs the following command on Router R1:

R1# show event manager history events

Event History:
No.  Time                Type                Name
1    00:01:30 UTC Mar 1  syslog              OSPF_Neighbor_Down
2    00:01:31 UTC Mar 1  syslog              OSPF_Neighbor_Up
3    00:01:32 UTC Mar 1  syslog              OSPF_Neighbor_Down
4    00:01:33 UTC Mar 1  syslog              OSPF_Neighbor_Up

Based on this output, which statement is correct?

Accepted Answer

The OSPF neighbor is flapping.. The event history shows alternating OSPF neighbor down and up events within seconds, indicating a flapping condition. The correct answer is that the OSPF neighbor is flapping.

Answer

The OSPF neighbor is stable.

Answer

The EEM policy is not configured.

Answer

The OSPF neighbor is down permanently.

Question 17

A network engineer runs the following command on Router R1:

R1# show event manager policy registered

No.  Type    Time Created            Name
1    applet  00:01:23 UTC Mar 1 2025  EIGRP_Neighbor_Down

R1# show event manager history events

Event History:
No.  Time                Type                Name
1    00:01:30 UTC Mar 1  syslog              EIGRP_Neighbor_Down

Based on this output, which statement is correct?

Accepted Answer

The EIGRP neighbor down event has occurred once.. The output shows one registered EEM applet policy and one triggered event. The correct answer is that the EIGRP neighbor down event has occurred once.

Answer

The EIGRP neighbor is currently down.

Answer

The EEM policy is disabled.

Answer

The EIGRP neighbor is flapping.

Question 18

A network engineer runs the following command on Router R1:

R1# show event manager policy registered

No.  Type    Time Created            Name
1    applet  00:01:23 UTC Mar 1 2025  BGP_Neighbor_Down

R1# show bgp neighbors 192.168.1.2

BGP neighbor is 192.168.1.2,  remote AS 65002, external link
  BGP version 4, remote router ID 10.0.0.2
  BGP state = Idle
  Last read 00:00:05, hold time is 180, keepalive interval is 60 seconds
  Neighbor sessions:
    1 active, is not multisession capable

Based on this output, what is the most likely conclusion?

Accepted Answer

The BGP neighbor is down, and the EEM policy may have been triggered.. The EEM policy BGP_Neighbor_Down is registered, and the BGP neighbor is in Idle state, indicating the session is down. The correct answer is that the BGP neighbor is down, and the EEM policy may have been triggered.

Answer

The BGP neighbor is up and running.

Answer

The EEM policy is not registered.

Answer

The BGP session is established.

Question 19

Consider the following EEM applet configuration:

!---
event manager applet CHECK_OSPF
event syslog pattern "OSPF-5-ADJCHG"
action 1.0 cli command "enable"
action 2.0 cli command "show ip ospf neighbor"
action 3.0 mail server "smtp.example.com" to "admin@example.com" from "router@example.com" subject "OSPF Adjacency Change" body "An OSPF adjacency change has been detected."
!---

What is the effect of this configuration?

Accepted Answer

The applet will send an email to the administrator whenever an OSPF adjacency change occurs.. The EEM applet triggers on a syslog message matching the pattern "OSPF-5-ADJCHG". When triggered, it sends an email notification to the administrator. The 'cli command' actions are executed but their output is not used; the email is sent regardless. The applet does not require any additional configuration to send the email, provided the mail server is reachable.

Answer

The applet will only execute the CLI commands and will not send an email because the mail server is not configured globally.

Answer

The applet will fail because the 'event syslog pattern' must be configured with a regular expression.

Answer

The applet will send the email only after the CLI commands complete, but the output of those commands is not included in the email.

Question 20

Examine the following EEM applet configuration:

!---
event manager applet LOGIN_ALERT
event syslog occurs 1 period 60
action 1.0 syslog msg "Login event detected"
!---

What is the problem with this configuration?

Accepted Answer

The 'event syslog occurs' command is missing the required 'pattern' keyword.. The 'event syslog occurs' command requires a pattern to match against syslog messages. Without a pattern, the applet will never trigger because the event is not properly defined. The correct syntax is 'event syslog pattern occurs period '.

Answer

The period of 60 seconds is too short and will cause high CPU usage.

Answer

The 'syslog msg' action cannot be used in the same applet as 'event syslog occurs'.

Answer

The applet will trigger on every syslog message, which is not the intended behavior.