hardMultiple ChoiceObjective-mapped
300-410 Practice Question: Configures EEM to monitor interface state changes…
A network engineer configures EEM to monitor interface state changes on R1. R1 has: event manager applet INT-MONITOR event syslog pattern "%LINEPROTO-5-UPDOWN" action 1.0 cli command "enable" action 2.0 cli command "show ip route" action 3.0 syslog msg "Interface state change detected". After a link flap on interface GigabitEthernet0/1, the engineer notices that the EEM applet runs multiple times, but the show ip route output is incomplete. Router R2 shows: routing table updates are delayed. What is the root cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The EEM applet executes before the routing protocol has converged, showing incomplete routing information.
The EEM applet runs immediately upon the syslog message, but the routing protocol may not have converged yet. The show ip route command may show stale or incomplete routes because the routing table update occurs asynchronously. The correct fix is to add a delay using 'action wait' before executing the show command.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The EEM applet executes before the routing protocol has converged, showing incomplete routing information.
Why this is correct
The applet runs immediately, but routing updates take time; adding a delay ensures accurate output.
- ✗
The syslog pattern matches too many events, causing the applet to run excessively.
Why it's wrong here
The pattern is correct; the issue is timing.
- ✗
The 'show ip route' command requires privileged mode, but the applet is already in privileged mode.
Why it's wrong here
The enable command ensures privileged mode; the issue is not privilege.
- ✗
The interface flap is causing routing protocol instability, not the EEM applet.
Why it's wrong here
The routing protocol instability is expected, but the EEM output is incomplete due to timing.
Quick reference
Routing Protocol Comparison
| Protocol | Metric | Max Hops | Algorithm | Type |
|---|---|---|---|---|
| RIP v2 | Hop count | 15 | Bellman-Ford | Distance vector |
| OSPF | Cost (bandwidth) | Unlimited | Dijkstra (SPF) | Link state |
| EIGRP | Composite metric | Unlimited | DUAL | Hybrid |
| IS-IS | Cost | Unlimited | Dijkstra | Link state |
| BGP | Policy / attributes | Unlimited | Path vector | Path vector |
RIP's 15-hop limit makes it unsuitable for large networks. OSPF and EIGRP dominate modern enterprise deployments.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 300-410 question from scratch — 1,966 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.