mediumMultiple Choice
300-410 Practice Question: Is troubleshooting an intermittent BGP session…
A network engineer is troubleshooting an intermittent BGP session failure between two routers. The BGP session drops every few hours and recovers after a few seconds. The engineer checks the logs and sees that an EEM applet is triggered just before each failure. The applet is configured to run a script that clears the BGP session when a specific syslog message is generated. What is the most likely cause of the BGP session failure?
⚠ Common exam trap
300-410 often tests the tendency to blame the network (physical layer, routing loop) when the logs explicitly show an automated tool (EEM) performing the disruptive action.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The EEM applet is clearing the BGP session as part of its configured action.
The logs show an EEM applet is triggered just before each BGP failure, and the applet is explicitly configured to clear the BGP session when a specific syslog message appears. This is a direct cause-and-effect: the applet's action (clearing BGP) is what is tearing down the session, not an underlying network fault.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The BGP session is failing due to a physical layer issue.
Why it's wrong here
A physical layer issue would produce interface flaps, CRC errors or link-down events, not a session cleared by an EEM applet reacting to a syslog message. It is tempting because intermittent faults often trace to cabling, but the logs show the applet's script is what tears the session down.
- ✓
The EEM applet is clearing the BGP session as part of its configured action.
Why this is correct
The EEM applet is configured to run a script that clears the BGP session whenever a specific syslog message appears. That scripted clear command is the direct trigger, explaining the periodic drops and immediate recovery, rather than any underlying transport or timer issue.
- ✗
The BGP session is failing due to a routing loop.
Why it's wrong here
A routing loop would cause persistent instability and TTL or hop-limit symptoms, not a clean periodic drop immediately preceded by an EEM applet clearing the session. It is tempting because loops do disrupt BGP, but here the applet's script is the direct trigger, so the loop is not the cause.
- ✗
The EEM applet is causing a memory leak that crashes the BGP process.
Why it's wrong here
The applet's script explicitly clears the BGP session on a syslog match, so the drops are deliberate, not a crash. Memory leaks degrade gradually and would not recover within seconds. EEM applets are designed for automated event-driven actions, such as clearing sessions on demand, which is legitimate when a specific trigger genuinely warrants a reset.
Go deeper
Related to this question
About these practice questions
This 300-410 question is part of Courseiva's 1,401-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.