easyMultiple Choice
300-410 Practice Question: Runs the following command on Router R1: R1# show…
A network engineer runs the following command on Router R1:
R1# show event manager policy registered
No. Type Time Created Name 1 applet 00:01:23 UTC Mar 1 2025 EIGRP_Neighbor_Down
R1# show event manager history events
Event History: No. Time Type Name 1 00:01:30 UTC Mar 1 syslog EIGRP_Neighbor_Down
Based on this output, which statement is correct?
⚠ Common exam trap
The trap is inferring current state or flapping from a history log — candidates read a single logged event as 'currently down' or 'flapping,' when the log only proves the event fired once in the past.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The EIGRP neighbor down event has occurred once.
The 'show event manager history events' output lists exactly one syslog event matching the EIGRP_Neighbor_Down policy, indicating the event fired once. The registered policy confirms the applet exists and is active, so the single history entry means the trigger has occurred one time.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The EIGRP neighbor down event has occurred once.
Why this is correct
The history table records one syslog event matching the EIGRP_Neighbor_Down applet, confirming the trigger fired a single time. The registered policy shows the applet exists but does not itself indicate occurrences, so the single history entry is the evidence that the neighbour-down condition occurred once.
- ✗
The EIGRP neighbor is currently down.
Why it's wrong here
The history table records that the syslog event fired at 00:01:30; it does not report the neighbour's current state. It is tempting because the applet name mentions a down neighbour, but the event merely triggered on that condition at that moment.
- ✗
The EEM policy is disabled.
Why it's wrong here
The policy appears in the registered list with an applet type, indicating it is registered and active; a disabled policy would not be listed as registered. Disabling applies when an engineer deliberately removes a policy from service, not here.
- ✗
The EIGRP neighbor is flapping.
Why it's wrong here
The history output shows a single syslog event, not repeated state transitions, so flapping is unsupported by the evidence. Flapping detection would require multiple up/down events over time, which this single-entry history does not demonstrate.
Quick reference
Routing Protocol Comparison
| Protocol | Metric | Max Hops | Algorithm | Type |
|---|---|---|---|---|
| RIP v2 | Hop count | 15 | Bellman-Ford | Distance vector |
| OSPF | Cost (bandwidth) | Unlimited | Dijkstra (SPF) | Link state |
| EIGRP | Composite metric | Unlimited | DUAL | Hybrid |
| IS-IS | Cost | Unlimited | Dijkstra | Link state |
| BGP | Policy / attributes | Unlimited | Path vector | Path vector |
RIP's 15-hop limit makes it unsuitable for large networks. OSPF and EIGRP dominate modern enterprise deployments.
Go deeper
Related to this question
About these practice questions
This 300-410 question is part of Courseiva's 1,401-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.