200-901 Cisco Platforms and Development Practice Question
An engineer is using EEM on an IOS XE device. They want to trigger an applet when a specific syslog message appears. Which event trigger type should they use?
⚠ Common exam trap
It's easy for candidates to confuse the trigger source — candidates often pick 'event cli match' because they conflate 'matching a pattern' with CLI input, when the question explicitly says a syslog message is the trigger.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
event syslog pattern
The 'event syslog pattern' trigger in EEM (Embedded Event Manager) is specifically designed to fire an applet when a syslog message matching a regex pattern is logged. It watches the device's syslog stream and activates the applet when the pattern matches. This is the canonical trigger for reacting to specific log events on IOS XE.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
event syslog pattern
Why this is correct
The `event syslog pattern` trigger matches syslog messages against a regular expression, firing the applet when the specified pattern appears in the device log. This directly satisfies the stem's requirement to react to a specific syslog message, unlike timer, interface, or SNMP-based triggers.
- ✗
event interface
Why it's wrong here
Interface events fire on line-protocol or interface state changes, not on log output, so a syslog match never reaches the applet. It is tempting because interface events are the standard trigger for reacting to a link going down or coming up, which is a genuinely different requirement.
- ✗
event cli match
Why it's wrong here
CLI match triggers on commands typed at the console or vty, not on messages written to the logging buffer, so the syslog line is never detected. It is tempting because CLI match suits auditing or blocking specific commands as an operator enters them.
- ✗
event timer
Why it's wrong here
Timer events fire on an absolute or periodic schedule, so the applet runs regardless of whether the syslog message ever appears. It is tempting because timers suit recurring maintenance tasks such as nightly configuration backups, where no log message needs to occur first.
Go deeper
Related to this question
About these practice questions
This 200-901 question is part of Courseiva's 975-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.