mediumMultiple Choice
300-410 Practice Question: Is troubleshooting a router that is experiencing…
A network engineer is troubleshooting a router that is experiencing intermittent packet loss. The engineer checks the logs and sees that an EEM applet is being triggered frequently. The applet is configured to run a script that modifies the routing table. The engineer suspects the applet is causing the packet loss. What should the engineer do to verify the root cause?
⚠ Common exam trap
The trap is choosing diagnostic commands that provide information but do not definitively prove causation, whereas the best method is to isolate the suspected cause by disabling it.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Temporarily disable the EEM applet and monitor the packet loss.
To verify if the EEM applet is causing the packet loss, the engineer should temporarily disable the applet and monitor whether the packet loss stops. This isolation test directly correlates the applet's activity with the symptom. If packet loss ceases when the applet is disabled, it confirms the applet as the root cause.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Check the EEM applet's script for errors.
Why it's wrong here
Reading the script for syntax or logic errors only proves the code is valid, not that its frequent routing-table rewrites are causing the loss. Script inspection is the right step when an applet fails outright or throws execution errors, not when correlating trigger frequency with intermittent packet loss.
- ✗
Use the 'show event manager statistics' command to see how often the applet is triggered.
Why it's wrong here
Trigger counts alone cannot confirm the applet is rewriting routes during the loss windows; the statistics show frequency, not the routing impact. This command is the correct choice when validating whether an applet fires as expected after configuration, not for correlating route changes with packet loss.
- ✓
Temporarily disable the EEM applet and monitor the packet loss.
Why this is correct
Disabling the EEM applet isolates the suspected trigger, so any change in packet loss confirms or eliminates it as the cause. This controlled test satisfies the need to verify the root cause rather than merely correlating frequent applet execution with the intermittent loss.
- ✗
Increase the logging level to debug to see more details.
Why it's wrong here
Raising logging to debug increases output volume and CPU load without proving the applet alters the routing table; it shows more messages, not causation. Debug logging suits diagnosing protocol or adjacency errors, where the fault lies in message exchanges rather than a triggered script.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 300-410 question from scratch — 1,401 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.