hardMultiple ChoiceObjective-mapped
300-410 Practice Question: Configures EEM to monitor routing table changes…
A network engineer configures EEM to monitor routing table changes on R1. R1 has: event manager applet ROUTE-MONITOR event syslog pattern "%ROUTING-5-ROUTECHANGE" action 1.0 cli command "enable" action 2.0 cli command "show ip route" action 3.0 syslog msg "Routing table changed". After a route update, the engineer notices that the applet runs but the show ip route output does not reflect the change. Router R2 shows: the route is present in the routing table. What is the root cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The syslog message is generated before the routing table is updated, so the show command shows the old table.
The syslog message %ROUTING-5-ROUTECHANGE is generated before the routing table is fully updated. The EEM applet runs immediately, capturing the routing table before the change is applied. The correct fix is to add a delay using 'action wait' to allow the routing table to converge.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The syslog message is generated before the routing table is updated, so the show command shows the old table.
Why this is correct
The applet executes before the routing table change is committed; a delay is needed.
- ✗
The syslog pattern is incorrect; it should be %ROUTING-5-ROUTECHANGED.
Why it's wrong here
The pattern matches the correct message.
- ✗
The routing protocol is not fully converged due to a hold-down timer.
Why it's wrong here
The route is present on R2, so convergence is fine; the issue is the EEM timing.
- ✗
The 'show ip route' command is not executed in privileged mode.
Why it's wrong here
The enable command ensures privileged mode.
Go deeper
Related to this question
About these practice questions
This 300-410 question is part of Courseiva's 1,966-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.