200-901 Cisco Platforms and Development Practice Question
A network administrator wants to use EEM on an IOS XE device to send a syslog message whenever a specific CLI command is entered. Which event detector should be used?
⚠ Common exam trap
A common mix-up: candidates confuse event detectors: candidates might think 'event syslog pattern' can detect CLI commands because CLI commands often generate syslog messages, but the detector specifically watches syslog output, not CLI input.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
event cli match
The 'event cli match' detector in EEM triggers when the CLI input on the device matches a specified regular expression pattern. This is exactly what the administrator needs: to detect when a specific CLI command is entered and then take action (send a syslog message). The 'match' keyword uses a regex to compare against the command string typed by the user.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
event syslog pattern
Why it's wrong here
The syslog pattern detector matches messages already generated and logged by the device; typing a CLI command does not itself emit a syslog message, so nothing triggers. It suits reacting to logged events like authentication failures, not command-entry monitoring.
- ✗
event interface
Why it's wrong here
The interface detector triggers on interface state changes such as line protocol up or down, which is unrelated to CLI command entry. It suits automating actions when a link flaps, not detecting that an administrator typed a particular command.
- ✓
event cli match
Why this is correct
The event cli detector triggers an EEM applet when CLI input matches a specified regular expression, which is exactly the requirement to react to a particular command being entered. Other detectors watch syslog, SNMP, timers or interface counters, none of which fire on command entry.
- ✗
event timer
Why it's wrong here
The timer detector fires on a scheduled interval or absolute time, independent of device activity, so it cannot react to a CLI command being entered. It suits recurring maintenance tasks such as periodic backups, not event-driven responses to configuration changes.
About these practice questions
Courseiva writes every 200-901 question from scratch — 975 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.