hardMultiple Choice
300-410 Practice Question: Runs the following command on Router R1: R1# show…
A network engineer runs the following command on Router R1:
R1# show event manager policy registered
No. Type Time Created Name 1 applet 00:01:23 UTC Mar 1 2025 BGP_Neighbor_Down
R1# show bgp neighbors 192.168.1.2
BGP neighbor is 192.168.1.2, remote AS 65002, external link BGP version 4, remote router ID 10.0.0.2 BGP state = Idle Last read 00:00:05, hold time is 180, keepalive interval is 60 seconds
Neighbor sessions:
1 active, is not multisession capable
Based on this output, what is the most likely conclusion?
⚠ Common exam trap
300-410 often tests whether candidates read BGP state output correctly — 'Idle' and 'Active' both mean the session is down, and only 'Established' means it is up; candidates who skim may assume a listed neighbor is automatically up.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The BGP neighbor is down, and the EEM policy may have been triggered.
The BGP neighbor 192.168.1.2 shows 'BGP state = Idle', which means the session is not established and the neighbor is down. The registered EEM applet named BGP_Neighbor_Down strongly suggests an event manager policy was configured to react to this exact condition, so it may have been triggered. The combination of Idle state plus a matching EEM policy name points to a down neighbor with automation in play.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The BGP neighbor is up and running.
Why it's wrong here
The output shows BGP state = Idle, meaning no session exists, so the neighbour cannot be up. The registered EEM applet BGP_Neighbor_Down is a tempting clue, but it only signals that a down event triggered; it does not indicate an active peering.
- ✓
The BGP neighbor is down, and the EEM policy may have been triggered.
Why this is correct
The neighbour sits in Idle state, meaning no TCP session or BGP peering is established with 192.168.1.2. The registered EEM applet BGP_Neighbor_Down monitors exactly this condition, so the transition to Idle plausibly triggered the policy, satisfying the stem's request for the most likely conclusion.
- ✗
The EEM policy is not registered.
Why it's wrong here
The registered-policy output lists BGP_Neighbor_Down as entry 1, so the policy is registered and active. It is tempting because the BGP neighbour sits in Idle, suggesting something is broken, but the EEM policy registration is confirmed by the table itself.
- ✗
The BGP session is established.
Why it's wrong here
BGP state = Idle proves the session is not established; Idle is the initial state before any TCP connection succeeds. The applet name BGP_Neighbor_Down tempts engineers to assume a working session being monitored, but the state field directly contradicts that.
Go deeper
Related to this question
About these practice questions
One of 1,401 original 300-410 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on 300-410
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A network engineer runs the following command on Router R1: R1# show event manager policy registered No. Type Time Created Name 1 applet 00:01:23 UTC Mar 1 2025 OSPF_Neighbor_Down R1# show ip ospf neighbor Neighbor ID Pri State Dead Time Address Interface 10.1.1.2 1 FULL/DR 00:00:36 192.168.1.2 GigabitEthernet0/0 Based on this output, what is the most likely conclusion?
medium- A.The OSPF neighbor is down.
- B.The EEM policy has been triggered.
- ✓ C.The EEM policy is registered but not yet triggered because the OSPF neighbor is up.
- D.The EEM policy is misconfigured.
Why C: The output shows the EEM policy 'OSPF_Neighbor_Down' is registered (listed in 'show event manager policy registered'), but the OSPF neighbor table shows the neighbor 10.1.1.2 in FULL/DR state with a Dead Time of 36 seconds, meaning the neighbor is up and stable. Therefore, the EEM policy has not been triggered because its triggering condition (OSPF neighbor down) has not occurred. The policy is simply waiting for the event.
Variation 2. A network engineer runs the following command on Router R1: R1# show event manager policy registered No. Type Time Created Name 1 applet 00:01:23 UTC Mar 1 2025 BGP_Neighbor_Down R1# show bgp summary BGP router identifier 10.0.0.1, local AS number 65001 BGP table version is 1, main routing table version 1 Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd 192.168.1.2 4 65002 5 5 1 0 0 00:02:00 Established Based on this output, which statement is correct?
medium- A.The BGP neighbor is down.
- B.The EEM policy has been triggered.
- ✓ C.The BGP neighbor is up and the EEM policy has not been triggered.
- D.The EEM policy is disabled.
Why C: The 'show bgp summary' output shows the neighbor 192.168.1.2 in state 'Established' with Up/Down 00:02:00, meaning the BGP session is up and stable. The EEM applet BGP_Neighbor_Down is registered but there is no evidence it has fired — the session never went down, so the trigger condition (neighbor down) was not met. Therefore the correct statement is that the neighbor is up and the EEM policy has not been triggered.
Variation 3. A network engineer runs the following command on Router R1: R1# show event manager policy registered No. Type Time Created Name 1 applet 00:01:23 UTC Mar 1 2025 EIGRP_Neighbor_Down R1# show ip eigrp neighbors IP-EIGRP neighbors for process 100 H Address Interface Hold Uptime SRTT RTO Q Seq (sec) (ms) Cnt Num 0 192.168.1.2 Gi0/0 13 00:02:00 40 200 0 5 Based on this output, what is the most likely problem?
hard- A.The EIGRP neighbor is down.
- B.The EEM policy has been triggered.
- ✓ C.The EIGRP neighbor is up, and the EEM policy is ready to trigger if it goes down.
- D.The EEM policy is misconfigured.
Why C: The 'show ip eigrp neighbors' output shows a neighbor with an uptime of 00:02:00 and a hold time of 13 seconds, meaning the adjacency is currently up and stable. The EEM applet named EIGRP_Neighbor_Down is registered and waiting; it has not fired because the neighbor has not gone down. Therefore the neighbor is up and the policy is armed to trigger only if the adjacency fails.
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.