200-901 Cisco Platforms and Development Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  event timer cron

  Why it's wrong here

  The cron event detector fires on a scheduled time or calendar interval, so it cannot react to a syslog message arriving. It is tempting because cron is the standard detector for recurring maintenance tasks, but matching log output requires the syslog event detector instead.

• ✗

  event interface

  Why it's wrong here

  The interface event detector triggers on interface state changes such as line protocol up or down, not on log text. It is tempting because interface events are common EEM triggers for link monitoring, but a syslog message requires the syslog event detector to match the pattern.

• ✗

  event cli pattern

  Why it's wrong here

  The cli pattern detector matches commands typed at the CLI, not syslog output generated by the device. It is tempting because pattern matching sounds applicable, but it watches interactive command input; the syslog event detector is what matches incoming log messages.

• ✓

  event syslog pattern

  Why this is correct

  The event syslog pattern detector matches incoming syslog messages against a regular expression, triggering the applet when the specified text appears. This directly satisfies the requirement to react to a specific syslog message rather than a timer or interface event.