Courseiva
← 300-410
Full test
hardMultiple ChoiceObjective-mapped

300-410 Practice Question: An engineer configures an EEM applet to monitor…

An engineer configures an EEM applet to monitor DMVPN tunnel events using the event syslog pattern 'NHRP-3-REGISTRATION'. The applet is supposed to send an email when a spoke registers with the NHS. The DMVPN network uses Phase 2 with spoke-to-spoke tunnels. A spoke registers successfully, but the EEM applet does not trigger. Which is the most likely explanation?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Successful NHRP registration generates a syslog message with severity 6 (informational), not severity 3 (error).

In DMVPN Phase 2, spoke-to-spoke tunnels are established dynamically, but the NHRP registration event generates a syslog message only when the spoke registers with the NHS. However, the syslog pattern 'NHRP-3-REGISTRATION' is for error-level messages, while successful registration generates an informational message (NHRP-6-REGISTRATION). The EEM applet is looking for severity level 3, but the actual syslog is severity level 6, so the pattern does not match.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✓

    Successful NHRP registration generates a syslog message with severity 6 (informational), not severity 3 (error).

    Why this is correct

    Correct. The pattern 'NHRP-3-REGISTRATION' is for errors; successful registration uses 'NHRP-6-REGISTRATION'.

  • ✗

    The EEM applet must be configured with 'event nhrp' to capture NHRP events.

    Why it's wrong here

    EEM does not have a native NHRP event trigger; syslog is used.

  • ✗

    The DMVPN Phase 2 does not generate syslog messages for spoke registration.

    Why it's wrong here

    It does generate syslog, but with a different severity.

  • ✗

    The NHS must be configured with 'ip nhrp registration no-syslog' to suppress messages.

    Why it's wrong here

    There is no such command; the issue is the severity level.

About these practice questions

This 300-410 question is part of Courseiva's 1,966-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

1 more way this is tested on 300-410

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. A network engineer configures an EEM applet to monitor IPsec tunnel failures using the event syslog pattern 'IPSEC-3-IPSEC'. The applet is designed to clear the IPsec security associations. The IPsec tunnel fails due to a transform-set mismatch, but the EEM applet does not trigger. Which is the most likely explanation?

hard
  • ✓ A.Transform-set mismatch generates an IPSEC syslog with severity 4, not severity 3.
  • B.The EEM applet must use 'event isakmp' to capture IPsec events.
  • C.The IPsec tunnel failure is not logged because the router drops the packet silently.
  • D.The transform-set mismatch causes a routing loop that suppresses syslog generation.

Why A: When an IPsec tunnel fails due to a transform-set mismatch, the IKE phase 2 negotiation fails, and the syslog message generated is typically 'IPSEC-4-IPSEC' (severity 4) or 'ISAKMP-4-ISAKMP' (severity 4) depending on the IOS version. The pattern 'IPSEC-3-IPSEC' is for severity 3 errors, which are used for more critical events like SA lifetime expiration or hardware failures. The transform-set mismatch is a negotiation failure, not a critical error, so the syslog severity is lower (4), and the EEM applet does not match.

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.