200-901 Cisco Platforms and Development Practice Question
A network engineer wants to automate a configuration change on a Cisco IOS XE device when a specific syslog message appears. Which tool should they use?
⚠ Common exam trap
It's easy for candidates to confuse EEM with external automation tools like RESTCONF or NETCONF, or assuming that SNMP traps can trigger CLI commands; candidates must remember that EEM is the native on-device automation engine for event-driven actions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
EEM applet configured to match the syslog pattern and execute CLI commands
EEM (Embedded Event Manager) is a built-in Cisco IOS XE feature that allows the device to react to local events, including syslog messages. An EEM applet can be configured with an event syslog pattern to match a specific syslog message and an action to execute CLI commands, enabling automated configuration changes directly on the device. This is the most direct and native way to trigger a configuration change based on a syslog message without external dependencies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
RESTCONF with a Python script polling the device
Why it's wrong here
Polling queries the device on a fixed schedule, so the syslog event is detected late and the change is not triggered by the message itself. It is tempting because RESTCONF can push configurations, but it would be correct for periodic state retrieval rather than event-driven reaction.
- ✗
SNMP trap receiver
Why it's wrong here
An SNMP trap receiver only collects asynchronous notifications; it cannot push configuration commands back to the device, so no change is applied. It is tempting because traps are event-driven, but it would be correct for monitoring and alerting rather than remediation.
- ✓
EEM applet configured to match the syslog pattern and execute CLI commands
Why this is correct
Embedded Event Manager applets run on the IOS XE device itself, matching syslog patterns via event statements and triggering CLI actions through action statements. This delivers the required local, event-driven automation without external orchestration tooling.
- ✗
NETCONF with a YANG-based notification subscription
Why it's wrong here
NETCONF notification subscriptions deliver YANG-model events such as config changes, not syslog messages, so the specific trigger never arrives. It is tempting because subscriptions are event-driven, but it would be correct for reacting to modelled datastore events instead of syslog output.
About these practice questions
This 200-901 question is part of Courseiva's 975-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.