hardMultiple ChoiceObjective-mapped
300-410 Practice Question: Configures EEM to monitor BGP prefix limits on R1
A network engineer configures EEM to monitor BGP prefix limits on R1. R1 has: event manager applet BGP-PREFIX event syslog pattern "%BGP-3-PREFIX_LIMIT" action 1.0 cli command "enable" action 2.0 cli command "clear ip bgp 10.1.1.2" action 3.0 syslog msg "Cleared BGP session". Router R2 shows: BGP session with R1 is flapping, and logs show repeated prefix limit warnings. What is the root cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The EEM applet clears the BGP session, which resets the prefix count but does not prevent the neighbor from re-sending the same prefixes.
The EEM applet clears the BGP session when a prefix limit is reached, but this does not solve the underlying issue. The prefix limit is exceeded because the neighbor is sending too many prefixes; clearing the session only temporarily resets the count, leading to a cycle. The correct fix is to increase the prefix limit or filter prefixes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The EEM applet clears the BGP session, which resets the prefix count but does not prevent the neighbor from re-sending the same prefixes.
Why this is correct
Clearing the session only provides temporary relief; the prefix limit is hit again after re-establishment.
- ✗
The syslog pattern is incorrect; it should be %BGP-4-PREFIX_LIMIT.
Why it's wrong here
The pattern matches the correct syslog message.
- ✗
The clear command should be 'clear ip bgp *' to reset all sessions.
Why it's wrong here
Clearing all sessions would cause more disruption; the issue is the underlying prefix limit.
- ✗
The BGP session is flapping due to a keepalive timer mismatch.
Why it's wrong here
No keepalive timer configuration is shown; the flapping is caused by the EEM clear command.
Go deeper
Related to this question
About these practice questions
One of 1,966 original 300-410 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.