easyMultiple Choice
300-410 Practice Question: Which EEM action type is used to modify the…
Which EEM action type is used to modify the configuration of the device?
⚠ Common exam trap
The trap is mixing up notification actions (syslog, snmp-trap, mail) with configuration actions; the exam tests that only 'action cli' can modify the device configuration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
action cli
The EEM action type 'action cli' is used to execute CLI commands on the device, which is how an EEM policy modifies the device configuration. When an event triggers the policy, the 'action cli' statements run the specified commands in configuration or exec mode, allowing the policy to change settings, apply ACLs, or shut down interfaces. This is the action type designed for configuration modification.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
action syslog
Why it's wrong here
'action syslog' writes a message to the logging buffer or syslog server; it changes no configuration. It is tempting because EEM applets commonly log events for auditing, and syslog is a familiar action, but configuration modification requires the CLI action that enters and commits commands.
- ✓
action cli
Why this is correct
The action cli applet action executes CLI commands on the device, including configuration-mode commands when the applet enters config mode. This makes it the mechanism for applying configuration changes in response to an EEM event.
- ✗
action snmp-trap
Why it's wrong here
The snmp-trap action sends an SNMP notification to a management station; it cannot alter device configuration. It is tempting because EEM is often used for alerting on threshold events, where generating a trap is exactly the right action.
- ✗
action mail
Why it's wrong here
The mail action sends an email alert to an operator; it cannot change device configuration. It is tempting because EEM applets commonly notify administrators of events, and email is the correct action when the goal is notification rather than remediation.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 300-410 question from scratch — 1,401 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.