hardMultiple ChoiceObjective-mapped
300-410 Practice Question: Configures EEM to monitor OSPF neighbor state…
A network engineer configures EEM to monitor OSPF neighbor state changes. R1 has: event manager applet OSPF-MON event syslog pattern "%OSPF-5-ADJCHG" action 1.0 cli command "enable" action 2.0 cli command "show ip ospf neighbor" action 3.0 syslog msg "OSPF neighbor change detected". After a link flap, the engineer notices that the EEM applet does not execute. Router R2 shows: OSPF neighbor state changes are logged, but no EEM actions occur. What is the root cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The syslog pattern matches, but the OSPF ADJCHG message is severity 5, which is below the default EEM syslog severity threshold of 4.
The EEM applet uses the syslog pattern trigger, but the OSPF ADJCHG message is logged at severity 5 (notification). By default, EEM syslog triggers only match severity 0-4 (emergency through warning). The engineer must adjust the logging severity or use a different trigger (e.g., event syslog pattern with severity).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The EEM applet is not registered correctly; it needs to be enabled with 'event manager applet OSPF-MON trigger'
Why it's wrong here
The applet is configured but the trigger condition is not met due to severity.
- ✓
The syslog pattern matches, but the OSPF ADJCHG message is severity 5, which is below the default EEM syslog severity threshold of 4.
Why this is correct
EEM syslog triggers require severity 0-4 by default; OSPF ADJCHG is severity 5.
- ✗
The 'action 1.0 cli command "enable"' fails because the applet is already in privileged mode.
Why it's wrong here
The enable command is needed to enter privileged mode; it does not cause failure.
- ✗
The OSPF neighbor change is not generating a syslog message due to logging buffer size.
Why it's wrong here
The syslog message is generated, but the EEM applet does not trigger due to severity.
Visual reference
Quick reference
Routing Protocol Comparison
| Protocol | Metric | Max Hops | Algorithm | Type |
|---|---|---|---|---|
| RIP v2 | Hop count | 15 | Bellman-Ford | Distance vector |
| OSPF | Cost (bandwidth) | Unlimited | Dijkstra (SPF) | Link state |
| EIGRP | Composite metric | Unlimited | DUAL | Hybrid |
| IS-IS | Cost | Unlimited | Dijkstra | Link state |
| BGP | Policy / attributes | Unlimited | Path vector | Path vector |
RIP's 15-hop limit makes it unsuitable for large networks. OSPF and EIGRP dominate modern enterprise deployments.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 300-410 question from scratch — 1,966 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.