Embedded Event Manager (EEM) practice questions

Study all Embedded Event Manager (EEM) common traps →

A network engineer is troubleshooting an intermittent BGP session failure between two routers. The BGP session drops every few hours and recovers after a few seconds. The engineer checks the logs and sees that an EEM applet is triggered just before each failure. The applet is configured to run a script that clears the BGP session when a specific syslog message is generated. What is the most likely cause of the BGP session failure?

Trap 1: The BGP session is failing due to a physical layer issue.

Incorrect because the logs show the EEM applet is triggered just before each failure, pointing to the applet as the cause, not a physical issue.

Trap 2: The BGP session is failing due to a routing loop.

Incorrect because a routing loop would not cause a session to drop and recover within seconds; the EEM trigger is the more direct cause.

Trap 3: The EEM applet is causing a memory leak that crashes the BGP…

Incorrect because the session recovers quickly, which is inconsistent with a process crash; the applet's clear action is the likely cause.

A
The BGP session is failing due to a physical layer issue.
Why wrong: Incorrect because the logs show the EEM applet is triggered just before each failure, pointing to the applet as the cause, not a physical issue.
B
The EEM applet is clearing the BGP session as part of its configured action.
Correct because the applet's action to clear the BGP session directly causes the session failure when triggered.
C
The BGP session is failing due to a routing loop.
Why wrong: Incorrect because a routing loop would not cause a session to drop and recover within seconds; the EEM trigger is the more direct cause.
D
The EEM applet is causing a memory leak that crashes the BGP process.
Why wrong: Incorrect because the session recovers quickly, which is inconsistent with a process crash; the applet's clear action is the likely cause.

Question 2mediummultiple choice

Study all Embedded Event Manager (EEM) common traps →

A network engineer notices that a router is sending SNMP traps for interface state changes even when there is no actual interface flapping. The engineer checks the running configuration and finds an EEM applet that monitors interface state changes and sends a syslog message. The applet is configured with a trigger condition that matches any interface state change. What should the engineer do to resolve the issue?

Trap 1: Remove the EEM applet entirely.

Incorrect because the applet may be needed for monitoring; a more targeted fix is to refine the trigger.

Trap 2: Increase the debounce timer on the interface to reduce flapping.

Incorrect because the issue is not actual flapping but an overly broad EEM trigger.

Trap 3: Disable SNMP traps for interface state changes.

Incorrect because the issue is with the EEM applet generating syslog messages, not with SNMP trap configuration.

A
Remove the EEM applet entirely.
Why wrong: Incorrect because the applet may be needed for monitoring; a more targeted fix is to refine the trigger.
B
Modify the EEM applet trigger to match only the specific interfaces of interest.
Correct because narrowing the trigger condition prevents false positives while retaining monitoring capability.
C
Increase the debounce timer on the interface to reduce flapping.
Why wrong: Incorrect because the issue is not actual flapping but an overly broad EEM trigger.
D
Disable SNMP traps for interface state changes.
Why wrong: Incorrect because the issue is with the EEM applet generating syslog messages, not with SNMP trap configuration.

Question 3hardmultiple choice

Study all Embedded Event Manager (EEM) common traps →

A network engineer is troubleshooting a router that fails to apply a specific configuration change after a reload. The engineer has an EEM applet that runs at boot time to apply a set of commands. After a reload, the engineer checks the configuration and finds that the commands were not applied. The applet is configured with event syslog pattern 'SYS-5-RESTART' and action cli command 'configure terminal'. What is the most likely cause of the failure?

Trap 1: The EEM applet is not enabled globally.

Incorrect because EEM is enabled by default; the issue is with the trigger timing.

Trap 2: The syslog pattern 'SYS-5-RESTART' is misspelled.

Incorrect because the pattern is correct, but the timing of the event may be the issue.

Trap 3: The EEM applet requires a 'event manager directory user' command to…

Incorrect because that command is for specifying script directories, not for boot-time applets.

A
The EEM applet is not enabled globally.
Why wrong: Incorrect because EEM is enabled by default; the issue is with the trigger timing.
B
The syslog pattern 'SYS-5-RESTART' is misspelled.
Why wrong: Incorrect because the pattern is correct, but the timing of the event may be the issue.
C
The EEM applet runs before the router is fully booted, so the CLI commands fail.
Correct because the syslog message may be generated early in the boot process, and the router may not be ready to accept configuration commands at that point.
D
The EEM applet requires a 'event manager directory user' command to be configured.
Why wrong: Incorrect because that command is for specifying script directories, not for boot-time applets.

Question 4mediummultiple choice

Study all Embedded Event Manager (EEM) common traps →

A network engineer is troubleshooting a router that is experiencing high CPU utilization. The engineer checks the process list and sees that the 'EEM Server' process is consuming a significant amount of CPU. The engineer reviews the EEM configuration and finds multiple applets that are triggered by syslog events. What should the engineer do first to reduce CPU utilization?

Trap 1: Disable all EEM applets.

Incorrect because this is too drastic; the engineer should first identify the problematic applet.

Trap 2: Increase the router's CPU priority for the EEM process.

Incorrect because this does not address the root cause of excessive triggers.

Trap 3: Change the syslog trigger to use a less frequent pattern.

Incorrect because this is a guess without first identifying which applet is causing the issue.

A
Disable all EEM applets.
Why wrong: Incorrect because this is too drastic; the engineer should first identify the problematic applet.
B
Use the 'show event manager statistics' command to see which applets are triggered most often.
Correct because this command provides per-applet trigger counts, helping pinpoint the culprit.
C
Increase the router's CPU priority for the EEM process.
Why wrong: Incorrect because this does not address the root cause of excessive triggers.
D
Change the syslog trigger to use a less frequent pattern.
Why wrong: Incorrect because this is a guess without first identifying which applet is causing the issue.

Question 5mediummultiple choice

Study all Embedded Event Manager (EEM) common traps →

A network engineer is troubleshooting a router that is not sending SNMP traps for a specific interface down event. The engineer has an EEM applet configured to send an SNMP trap when the interface goes down. The applet uses event syslog pattern 'LINK-3-UPDOWN' and action snmp-trap. The interface goes down, but no trap is sent. What is the most likely cause?

Trap 1: The syslog pattern 'LINK-3-UPDOWN' is incorrect; the correct…

Incorrect because 'LINK-3-UPDOWN' is a valid syslog message for interface state changes.

Trap 2: The EEM applet is not registered with the SNMP agent.

Incorrect because EEM applets do not need to be registered with SNMP; they use the SNMP trap action directly.

Trap 3: The SNMP trap action requires an SNMP community string to be…

Incorrect because the SNMP trap action uses the global SNMP configuration; however, the trap destination must be configured.

A
The syslog pattern 'LINK-3-UPDOWN' is incorrect; the correct pattern is 'LINK-5-CHANGED'.
Why wrong: Incorrect because 'LINK-3-UPDOWN' is a valid syslog message for interface state changes.
B
The EEM applet is not registered with the SNMP agent.
Why wrong: Incorrect because EEM applets do not need to be registered with SNMP; they use the SNMP trap action directly.
C
The SNMP trap action requires an SNMP community string to be specified in the applet.
Why wrong: Incorrect because the SNMP trap action uses the global SNMP configuration; however, the trap destination must be configured.
D
The SNMP trap destination is not configured globally.
Correct because the EEM applet's SNMP trap action sends traps to the configured SNMP trap receivers; if none are configured, the trap is not sent.

Question 6hardmultiple choice

Study all Embedded Event Manager (EEM) common traps →

A network engineer is troubleshooting a router that is not executing an EEM applet that is supposed to run when a specific interface goes down. The applet is configured with event syslog pattern 'LINK-3-UPDOWN' and matches the interface with a regex. The engineer checks the syslog and sees the message 'LINK-3-UPDOWN: GigabitEthernet0/1, changed state to down' but the applet does not run. What is the most likely cause?

Trap 1: The EEM applet is disabled.

Incorrect because if the applet were disabled, it would not appear in the configuration; the engineer likely checked the config.

Trap 2: The syslog message is not being sent to the EEM server due to…

Incorrect because the syslog message is generated and visible; EEM intercepts syslog messages regardless of logging destination.

Trap 3: The interface is not being monitored because it is a subinterface.

Incorrect because the syslog message indicates the interface is GigabitEthernet0/1, which is a physical interface.

A
The EEM applet is disabled.
Why wrong: Incorrect because if the applet were disabled, it would not appear in the configuration; the engineer likely checked the config.
B
The syslog message is not being sent to the EEM server due to logging level restrictions.
Why wrong: Incorrect because the syslog message is generated and visible; EEM intercepts syslog messages regardless of logging destination.
C
The regex pattern in the applet does not match the syslog message.
Correct because a mismatch in the regex pattern is a common cause for an applet not triggering.
D
The interface is not being monitored because it is a subinterface.
Why wrong: Incorrect because the syslog message indicates the interface is GigabitEthernet0/1, which is a physical interface.

Question 7easymultiple choice

Study all Embedded Event Manager (EEM) common traps →

A network engineer is troubleshooting a router that is sending duplicate SNMP traps for interface state changes. The engineer finds two EEM applets that both trigger on the same syslog pattern 'LINK-3-UPDOWN' and both send SNMP traps. What should the engineer do to resolve the duplicate traps?

Trap 1: Disable syslog logging for interface state changes.

Incorrect because this would affect other monitoring; the issue is redundant EEM applets.

Trap 2: Change the SNMP trap destination to a different host for one applet.

Incorrect because this would still send two traps to different hosts, not resolve the duplication.

Trap 3: Increase the SNMP trap queue size.

Incorrect because this does not address the root cause of duplicate traps.

A
Disable syslog logging for interface state changes.
Why wrong: Incorrect because this would affect other monitoring; the issue is redundant EEM applets.
B
Remove one of the duplicate EEM applets.
Correct because removing one applet eliminates the duplicate trap generation.
C
Change the SNMP trap destination to a different host for one applet.
Why wrong: Incorrect because this would still send two traps to different hosts, not resolve the duplication.
D
Increase the SNMP trap queue size.
Why wrong: Incorrect because this does not address the root cause of duplicate traps.

Question 8hardmultiple choice

Study all Embedded Event Manager (EEM) common traps →

A network engineer is troubleshooting a router that is not generating any EEM applet actions even though the applets are configured and enabled. The engineer checks the 'show event manager status' command and sees that the EEM server is running. The engineer also checks the syslog and sees that the trigger events are occurring. What is the most likely cause?

Trap 1: The EEM server is not listening for syslog events.

Incorrect because the EEM server automatically listens for syslog events if configured; the issue is with applet registration.

Trap 2: The router's logging level is set to emergencies only.

Incorrect because EEM intercepts syslog messages regardless of logging level; the trigger events are occurring as per the engineer's observation.

Trap 3: The EEM applets are configured with 'event none' and need manual…

Incorrect because the engineer states that trigger events are occurring, so the applets should be triggered if registered.

A
The EEM applets are not registered due to a syntax error in the configuration.
Correct because a syntax error prevents the applet from being registered, even if the EEM server is running.
B
The EEM server is not listening for syslog events.
Why wrong: Incorrect because the EEM server automatically listens for syslog events if configured; the issue is with applet registration.
C
The router's logging level is set to emergencies only.
Why wrong: Incorrect because EEM intercepts syslog messages regardless of logging level; the trigger events are occurring as per the engineer's observation.
D
The EEM applets are configured with 'event none' and need manual triggering.
Why wrong: Incorrect because the engineer states that trigger events are occurring, so the applets should be triggered if registered.

Review the full routing breakdown →

Question 9mediummultiple choice

A network engineer is troubleshooting a router that is experiencing intermittent packet loss. The engineer checks the logs and sees that an EEM applet is being triggered frequently. The applet is configured to run a script that modifies the routing table. The engineer suspects the applet is causing the packet loss. What should the engineer do to verify the root cause?

Trap 1: Check the EEM applet's script for errors.

Incorrect because this does not directly correlate the applet's execution with packet loss; disabling the applet is a more direct test.

Trap 2: Use the 'show event manager statistics' command to see how often…

Incorrect because this only shows frequency, not whether it causes packet loss.

Trap 3: Increase the logging level to debug to see more details.

Incorrect because this adds overhead and does not directly isolate the cause.

Study all Embedded Event Manager (EEM) common traps →

A
Check the EEM applet's script for errors.
Why wrong: Incorrect because this does not directly correlate the applet's execution with packet loss; disabling the applet is a more direct test.
B
Use the 'show event manager statistics' command to see how often the applet is triggered.
Why wrong: Incorrect because this only shows frequency, not whether it causes packet loss.
C
Temporarily disable the EEM applet and monitor the packet loss.
Correct because disabling the applet and observing if packet loss stops confirms the applet as the cause.
D
Increase the logging level to debug to see more details.
Why wrong: Incorrect because this adds overhead and does not directly isolate the cause.

Question 10mediummultiple choice

Study all Embedded Event Manager (EEM) common traps →

A network engineer runs the following command on Router R1:

R1# show event manager policy registered

No. Type Time Created Name 1 applet 00:01:23 UTC Mar 1 2025 EIGRP_Neighbor_Down 2 applet 00:01:23 UTC Mar 1 2025 OSPF_Neighbor_Flap

Based on this output, which statement is correct?

Trap 1: Two EEM applet policies are registered but disabled.

The output does not show any disabled status; registration implies they are active unless explicitly disabled.

Trap 2: Only one EEM applet policy is registered.

The output clearly lists two policies: EIGRP_Neighbor_Down and OSPF_Neighbor_Flap.

Trap 3: The EEM applet policies are triggered by syslog events.

The output does not show the trigger events; it only lists the policy names and registration time.

A
Two EEM applet policies are registered and active.
The output shows two applet policies registered, meaning they are loaded and ready to trigger based on their defined events.
B
Two EEM applet policies are registered but disabled.
Why wrong: The output does not show any disabled status; registration implies they are active unless explicitly disabled.
C
Only one EEM applet policy is registered.
Why wrong: The output clearly lists two policies: EIGRP_Neighbor_Down and OSPF_Neighbor_Flap.
D
The EEM applet policies are triggered by syslog events.
Why wrong: The output does not show the trigger events; it only lists the policy names and registration time.

Question 11hardmultiple choice

Study all Embedded Event Manager (EEM) common traps →

A network engineer runs the following command on Router R1:

R1# show event manager history events

Event History: No. Time Type Name 1 00:01:30 UTC Mar 1 syslog EIGRP_Neighbor_Down 2 00:01:31 UTC Mar 1 syslog OSPF_Neighbor_Flap 3 00:01:32 UTC Mar 1 syslog EIGRP_Neighbor_Down 4 00:01:33 UTC Mar 1 syslog OSPF_Neighbor_Flap

Based on this output, what is the most likely problem?

Trap 1: The EEM policies are not configured correctly.

The policies are triggering, so they are configured correctly.

Trap 2: The EEM applet policies are disabled.

Events are being triggered, so policies are active.

Trap 3: The syslog server is not reachable.

The events are logged locally; syslog reachability is not indicated.

A
The EEM policies are not configured correctly.
Why wrong: The policies are triggering, so they are configured correctly.
B
The router is experiencing network instability causing repeated neighbor state changes.
The repeated events within seconds indicate flapping, likely due to link issues or routing problems.
C
The EEM applet policies are disabled.
Why wrong: Events are being triggered, so policies are active.
D
The syslog server is not reachable.
Why wrong: The events are logged locally; syslog reachability is not indicated.

Question 12mediummultiple choice

Study all Embedded Event Manager (EEM) common traps →

A network engineer runs the following command on Router R1:

R1# show event manager policy registered

No. Type Time Created Name 1 applet 00:01:23 UTC Mar 1 2025 BGP_Session_Reset

R1# show event manager history events

Event History: No. Time Type Name 1 00:02:00 UTC Mar 1 syslog BGP_Session_Reset 2 00:02:05 UTC Mar 1 syslog BGP_Session_Reset 3 00:02:10 UTC Mar 1 syslog BGP_Session_Reset

Based on this output, which statement is correct?

Trap 1: The EEM policy is not triggering any events.

The event history shows three triggers.

Trap 2: The BGP session is stable.

Multiple resets indicate instability.

Trap 3: The EEM policy is disabled.

The policy is registered and events are being triggered, so it is active.

A
The BGP session reset event has occurred three times.
The event history shows three entries for BGP_Session_Reset, each at different times.
B
The EEM policy is not triggering any events.
Why wrong: The event history shows three triggers.
C
The BGP session is stable.
Why wrong: Multiple resets indicate instability.
D
The EEM policy is disabled.
Why wrong: The policy is registered and events are being triggered, so it is active.

Question 13mediummultiple choice

Study all Embedded Event Manager (EEM) common traps →

A network engineer runs the following command on Router R1:

R1# show event manager policy registered

No. Type Time Created Name 1 applet 00:01:23 UTC Mar 1 2025 OSPF_Neighbor_Down

R1# show ip ospf neighbor

Neighbor ID     Pri   State           Dead Time   Address         Interface
10.1.1.2         1   FULL/DR         00:00:36    192.168.1.2     GigabitEthernet0/0

Based on this output, what is the most likely conclusion?

Trap 1: The OSPF neighbor is down.

The neighbor state is FULL, indicating it is up.

Trap 2: The EEM policy has been triggered.

There is no evidence of triggering; the neighbor is up.

Trap 3: The EEM policy is misconfigured.

There is no indication of misconfiguration; the policy is registered and ready.

A
The OSPF neighbor is down.
Why wrong: The neighbor state is FULL, indicating it is up.
B
The EEM policy has been triggered.
Why wrong: There is no evidence of triggering; the neighbor is up.
C
The EEM policy is registered but not yet triggered because the OSPF neighbor is up.
The neighbor state FULL shows the neighbor is operational, so the down event has not occurred.
D
The EEM policy is misconfigured.
Why wrong: There is no indication of misconfiguration; the policy is registered and ready.

Question 14mediummultiple choice

Study all Embedded Event Manager (EEM) common traps →

A network engineer runs the following command on Router R1:

R1# show event manager policy registered

No. Type Time Created Name 1 applet 00:01:23 UTC Mar 1 2025 BGP_Neighbor_Down

R1# show bgp summary

BGP router identifier 10.0.0.1, local AS number 65001 BGP table version is 1, main routing table version 1

Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
192.168.1.2     4        65002       5       5        1    0    0 00:02:00 Established

Based on this output, which statement is correct?

Trap 1: The BGP neighbor is down.

The state is Established, indicating it is up.

Trap 2: The EEM policy has been triggered.

No event history is shown, and the neighbor is up.

Trap 3: The EEM policy is disabled.

The policy is registered, so it is active.

A
The BGP neighbor is down.
Why wrong: The state is Established, indicating it is up.
B
The EEM policy has been triggered.
Why wrong: No event history is shown, and the neighbor is up.
C
The BGP neighbor is up and the EEM policy has not been triggered.
The Established state confirms the neighbor is up, so the down event has not occurred.
D
The EEM policy is disabled.
Why wrong: The policy is registered, so it is active.

Study the full EIGRP explanation →

Question 15hardmultiple choice

A network engineer runs the following command on Router R1:

R1# show event manager policy registered

No. Type Time Created Name 1 applet 00:01:23 UTC Mar 1 2025 EIGRP_Neighbor_Down

R1# show ip eigrp neighbors

IP-EIGRP neighbors for process 100 H Address Interface Hold Uptime SRTT RTO Q Seq (sec) (ms) Cnt Num 0 192.168.1.2 Gi0/0 13 00:02:00 40 200 0 5

Based on this output, what is the most likely problem?

Trap 1: The EIGRP neighbor is down.

The neighbor is listed with an uptime, indicating it is up.

Trap 2: The EEM policy has been triggered.

No event history shows triggering, and the neighbor is up.

Trap 3: The EEM policy is misconfigured.

There is no indication of misconfiguration.

Study all Embedded Event Manager (EEM) common traps →

A
The EIGRP neighbor is down.
Why wrong: The neighbor is listed with an uptime, indicating it is up.
B
The EEM policy has been triggered.
Why wrong: No event history shows triggering, and the neighbor is up.
C
The EIGRP neighbor is up, and the EEM policy is ready to trigger if it goes down.
The neighbor is operational, so the down event has not occurred.
D
The EEM policy is misconfigured.
Why wrong: There is no indication of misconfiguration.

Question 16mediummultiple choice

Study all Embedded Event Manager (EEM) common traps →

A network engineer runs the following command on Router R1:

R1# show event manager history events

Event History: No. Time Type Name 1 00:01:30 UTC Mar 1 syslog OSPF_Neighbor_Down 2 00:01:31 UTC Mar 1 syslog OSPF_Neighbor_Up 3 00:01:32 UTC Mar 1 syslog OSPF_Neighbor_Down 4 00:01:33 UTC Mar 1 syslog OSPF_Neighbor_Up

Based on this output, which statement is correct?

Trap 1: The OSPF neighbor is stable.

Alternating down and up events indicate instability.

Trap 2: The EEM policy is not configured.

Events are being logged, so a policy is configured.

Trap 3: The OSPF neighbor is down permanently.

The up events show it comes back up.

A
The OSPF neighbor is stable.
Why wrong: Alternating down and up events indicate instability.
B
The OSPF neighbor is flapping.
The rapid succession of down and up events is characteristic of flapping.
C
The EEM policy is not configured.
Why wrong: Events are being logged, so a policy is configured.
D
The OSPF neighbor is down permanently.
Why wrong: The up events show it comes back up.

Study the full EIGRP explanation →

Question 17easymultiple choice

A network engineer runs the following command on Router R1:

R1# show event manager policy registered

No. Type Time Created Name 1 applet 00:01:23 UTC Mar 1 2025 EIGRP_Neighbor_Down

R1# show event manager history events

Event History: No. Time Type Name 1 00:01:30 UTC Mar 1 syslog EIGRP_Neighbor_Down

Based on this output, which statement is correct?

Trap 1: The EIGRP neighbor is currently down.

The event history does not indicate current state; it only shows past events.

Trap 2: The EEM policy is disabled.

The policy is registered and an event was triggered, so it is active.

Trap 3: The EIGRP neighbor is flapping.

Only one event is recorded, so no flapping is indicated.

Study all Embedded Event Manager (EEM) common traps →

A
The EIGRP neighbor down event has occurred once.
The event history shows a single entry for EIGRP_Neighbor_Down.
B
The EIGRP neighbor is currently down.
Why wrong: The event history does not indicate current state; it only shows past events.
C
The EEM policy is disabled.
Why wrong: The policy is registered and an event was triggered, so it is active.
D
The EIGRP neighbor is flapping.
Why wrong: Only one event is recorded, so no flapping is indicated.

Question 18hardmultiple choice

Study all Embedded Event Manager (EEM) common traps →

A network engineer runs the following command on Router R1:

R1# show event manager policy registered

No. Type Time Created Name 1 applet 00:01:23 UTC Mar 1 2025 BGP_Neighbor_Down

R1# show bgp neighbors 192.168.1.2

BGP neighbor is 192.168.1.2, remote AS 65002, external link BGP version 4, remote router ID 10.0.0.2 BGP state = Idle Last read 00:00:05, hold time is 180, keepalive interval is 60 seconds

Neighbor sessions:

1 active, is not multisession capable

Based on this output, what is the most likely conclusion?

Trap 1: The BGP neighbor is up and running.

The state is Idle, which means the session is down.

Trap 2: The EEM policy is not registered.

The policy is listed as registered.

Trap 3: The BGP session is established.

Idle state means not established.

A
The BGP neighbor is up and running.
Why wrong: The state is Idle, which means the session is down.
B
The BGP neighbor is down, and the EEM policy may have been triggered.
The Idle state indicates the session is down, which would likely trigger the BGP_Neighbor_Down event.
C
The EEM policy is not registered.
Why wrong: The policy is listed as registered.
D
The BGP session is established.
Why wrong: Idle state means not established.

Question 19mediummultiple choice

Study all Embedded Event Manager (EEM) common traps →

Consider the following EEM applet configuration:

!--- event manager applet CHECK_OSPF event syslog pattern "OSPF-5-ADJCHG" action 1.0 cli command "enable" action 2.0 cli command "show ip ospf neighbor" action 3.0 mail server "smtp.example.com" to "admin@example.com" from "router@example.com" subject "OSPF Adjacency Change" body "An OSPF adjacency change has been detected." !---

What is the effect of this configuration?

Trap 1: The applet will only execute the CLI commands and will not send an…

Incorrect. The 'mail server' command is specified directly in the action; no global mail configuration is required.

Trap 2: The applet will fail because the 'event syslog pattern' must be…

Incorrect. The pattern can be a simple string; regular expressions are optional.

Trap 3: The applet will send the email only after the CLI commands…

Incorrect. The CLI commands are executed, but their output is not automatically included in the email. The email body is static as defined.

A
The applet will send an email to the administrator whenever an OSPF adjacency change occurs.
Correct. The applet triggers on the OSPF adjacency change syslog message and sends an email with the specified details.
B
The applet will only execute the CLI commands and will not send an email because the mail server is not configured globally.
Why wrong: Incorrect. The 'mail server' command is specified directly in the action; no global mail configuration is required.
C
The applet will fail because the 'event syslog pattern' must be configured with a regular expression.
Why wrong: Incorrect. The pattern can be a simple string; regular expressions are optional.
D
The applet will send the email only after the CLI commands complete, but the output of those commands is not included in the email.
Why wrong: Incorrect. The CLI commands are executed, but their output is not automatically included in the email. The email body is static as defined.

Question 20mediummultiple choice

Study all Embedded Event Manager (EEM) common traps →

Examine the following EEM applet configuration:

!--- event manager applet LOGIN_ALERT event syslog occurs 1 period 60 action 1.0 syslog msg "Login event detected" !---

What is the problem with this configuration?

Trap 1: The period of 60 seconds is too short and will cause high CPU usage.

Incorrect. The period value is valid; the issue is the missing pattern.

Trap 2: The 'syslog msg' action cannot be used in the same applet as 'event…

Incorrect. The 'syslog msg' action can be used in any EEM applet.

Trap 3: The applet will trigger on every syslog message, which is not the…

Incorrect. Without a pattern, the event is invalid and the applet will not trigger at all.

A
The 'event syslog occurs' command is missing the required 'pattern' keyword.
Correct. The event must specify a pattern to match; otherwise, the applet will not trigger.
B
The period of 60 seconds is too short and will cause high CPU usage.
Why wrong: Incorrect. The period value is valid; the issue is the missing pattern.
C
The 'syslog msg' action cannot be used in the same applet as 'event syslog occurs'.
Why wrong: Incorrect. The 'syslog msg' action can be used in any EEM applet.
D
The applet will trigger on every syslog message, which is not the intended behavior.
Why wrong: Incorrect. Without a pattern, the event is invalid and the applet will not trigger at all.