hardMultiple ChoiceObjective-mapped
300-410 Practice Question: A large enterprise network is experiencing…
A large enterprise network is experiencing intermittent BGP session resets between R1 and R2. R1 has the following relevant configuration: event manager applet BGP-MONITOR event syslog pattern "%BGP-3-NOTIFICATION" action 1.0 cli command "enable" action 2.0 cli command "clear ip bgp *" action 3.0 syslog msg "BGP session cleared by EEM". Router R2 shows: BGP neighbor 10.1.1.1 has been up for 0:00:05, state Established. What is the root cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The EEM applet is triggered by the BGP notification and clears all BGP sessions, causing a reset loop.
The EEM applet triggers on any BGP notification syslog and then executes a clear ip bgp * command, which resets all BGP sessions. This creates a loop: a BGP notification causes a clear, which causes more notifications, leading to persistent flapping. The correct fix is to make the applet more specific or avoid clearing all sessions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The EEM applet is triggered by the BGP notification and clears all BGP sessions, causing a reset loop.
Why this is correct
The applet clears all BGP sessions upon any BGP notification, which exacerbates the issue.
- ✗
The BGP keepalive timer is set too low on R1.
Why it's wrong here
No keepalive timer configuration is shown; the issue is the EEM applet.
- ✗
The syslog pattern is incorrect and matches unrelated messages.
Why it's wrong here
The pattern matches BGP notifications correctly, but the action causes the problem.
- ✗
There is an MTU mismatch between R1 and R2.
Why it's wrong here
No evidence of MTU issues; the problem is the EEM clear command.
Go deeper
Related to this question
About these practice questions
This 300-410 question is part of Courseiva's 1,966-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 300-410
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A network engineer is troubleshooting an intermittent BGP session failure between two routers. The BGP session drops every few hours and recovers after a few seconds. The engineer checks the logs and sees that an EEM applet is triggered just before each failure. The applet is configured to run a script that clears the BGP session when a specific syslog message is generated. What is the most likely cause of the BGP session failure?
medium- A.The BGP session is failing due to a physical layer issue.
- ✓ B.The EEM applet is clearing the BGP session as part of its configured action.
- C.The BGP session is failing due to a routing loop.
- D.The EEM applet is causing a memory leak that crashes the BGP process.
Why B: The EEM applet is the root cause because it is configured to clear the BGP session upon a specific syslog event. The engineer should review the applet's trigger condition and action to identify why it is being triggered incorrectly or unnecessarily.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.