mediumMultiple Choice
300-410 Practice Question: Runs the following command on Router R1: R1# show…
A network engineer runs the following command on Router R1:
R1# show event manager policy registered
No. Type Time Created Name 1 applet 00:01:23 UTC Mar 1 2025 BGP_Neighbor_Down
R1# show bgp summary
BGP router identifier 10.0.0.1, local AS number 65001 BGP table version is 1, main routing table version 1
Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd 192.168.1.2 4 65002 5 5 1 0 0 00:02:00 Established
Based on this output, which statement is correct?
⚠ Common exam trap
The trap is assuming that because an EEM policy is registered it must have triggered — candidates conflate 'registered/armed' with 'executed', but registration only means the policy is loaded and waiting for its event detector.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The BGP neighbor is up and the EEM policy has not been triggered.
The 'show bgp summary' output shows the neighbor 192.168.1.2 in state 'Established' with Up/Down 00:02:00, meaning the BGP session is up and stable. The EEM applet BGP_Neighbor_Down is registered but there is no evidence it has fired — the session never went down, so the trigger condition (neighbor down) was not met. Therefore the correct statement is that the neighbor is up and the EEM policy has not been triggered.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The BGP neighbor is down.
Why it's wrong here
The State/PfxRcd column shows Established with zero prefixes received, so the session is up and exchanging messages. The neighbour is reachable and the peering is formed; zero prefixes indicates no routes advertised, not a down neighbour. A down state would display Idle, Active or Connect in that column.
- ✗
The EEM policy has been triggered.
Why it's wrong here
Triggering would require the monitored syslog or SNMP event, here a BGP neighbour transition, which has not occurred because the session is Established. The policy is registered and waiting. Triggered status is the right conclusion only after the neighbour actually drops and the applet fires.
- ✓
The BGP neighbor is up and the EEM policy has not been triggered.
Why this is correct
The BGP summary shows the neighbour in Established state with two minutes uptime, so the session is healthy. The EEM applet BGP_Neighbor_Down triggers only on a transition away from Established, which has not occurred, so the policy remains untriggered.
- ✗
The EEM policy is disabled.
Why it's wrong here
Registration is confirmed by the policy appearing in the registered list, which shows it is loaded and active; disabled policies are absent from that output. The applet is registered but simply has not fired because the neighbour remains Established. Disabling is the right diagnosis only when the policy is missing from the registered list.
Go deeper
Related to this question
About these practice questions
This 300-410 question is part of Courseiva's 1,401-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.