easyMultiple Choice
300-410 Practice Question: EEM event types can be used to trigger an applet…
Which of the following EEM event types can be used to trigger an applet based on a specific IOS command being entered?
⚠ Common exam trap
The trap is confusing 'event cli' with 'event syslog'. Candidates might think that CLI commands generate syslog messages, but 'event cli' directly intercepts CLI input, which is more specific and immediate.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
event cli
The 'event cli' event type in EEM triggers an applet when a specific CLI command is entered. This allows automation based on command execution, such as running a script when a particular show command is issued. The other event types trigger on different conditions: syslog patterns, SNMP OIDs, or timers.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
event syslog
Why it's wrong here
Syslog events trigger on log messages matching a pattern, not on CLI command entry; the command itself generates no syslog message by default. It would be correct for reacting to interface-down or configuration-change log output, where a matching syslog string is the intended trigger.
- ✗
event snmp
Why it's wrong here
SNMP events fire on trap or object-value changes polled from the device, not on interactive CLI input. This is the right choice when an applet must react to an MIB threshold breach or received trap, such as interface utilisation crossing a set value.
- ✓
event cli
Why this is correct
The event cli event type triggers an EEM applet when a specified IOS command matching a configured regular expression is entered on the CLI. This directly satisfies the requirement to react to a specific command being typed, unlike syslog or timer events.
- ✗
event timer
Why it's wrong here
Timer events fire on a cron-like schedule or absolute time, independent of any user action, so an entered command cannot trigger them. Timer is correct for recurring maintenance tasks, such as saving configuration nightly or running a periodic poll.
Go deeper
Related to this question
About these practice questions
This 300-410 question is part of Courseiva's 1,401-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.