Exam 350-401 topic 1 question 753 discussion

This one is tricky. Please, pay attention to the wordings. With the command “show ip arp | in 0005.4278.9866”, the “ARPR” text is only found if this MAC address has been learned in the router. Answer A is not correct as the syslog message is only generated if the specific MAC address is found (not every 600 seconds).

It's D. The ARP table is checked every 600 seconds, but the syslog message is generated only if the specific MAC address is found, it's not generated every 600 seconds. If the MAC isn't found, no syslog message is generated. if $_regexp_result eq 1 <-- if the MAC is found... syslog msg $_cli_result <-- ...then generate a syslog entry, otherwise do nothing

The Syslog msg will be generated only if we find a match for the MAC address (0005.4210.0049) in the ARP table.

The following example shows how to specify that an event is triggered every 5 hours: Router(config)# event manager applet timer-watch Router(config-applet)# event timer watchdog time 18000 https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/eem/command/eem-cr-book/eem-cr-e2.html

D is more accurate as it describes the regular checking behavior without implying that a syslog message is always generated. A is incorrect because the applet will only send a syslog message if the specified MAC address is found in the ARP table, not every 600 sec. If the MAC address is not present in the ARP table, the syslog message will not be generated, but the applet will continue to check every 600 seconds.

The EEM applet checks the ARP table every 10 minutes for a specific MAC address. If an ARP entry is found for that MAC address, it logs the entire line containing that ARP entry to the syslog server. This could be used for monitoring when a specific device (identified by its MAC address) is active on the network and logging its IP address assignments over time.

It's A Read Engish. It generates a syslog message. None of the other answers say that. and action 7 generates a syslog message. I tested this in my lab. D does NOT check a mac address table, it checks the arp table.

The correct answers are A and D. This question should have a (choose two) options answer. They must have forgotten to say, "choose two". The EEM script does A and D.

A. It DOESN'T generate a syslog message every 600 seconds - if only MAC exists B. it DOESN'T It compare syslog output- it compares cli output C. It DOESN'T compare syslog output - it compares cli output D. It DOESN'T check the MAC address table - it checks ARP

Poorly described ansers :( None is correct. It does not *generete every 600 seconds*, it *checks every 600 seconds* if the MAC address is present in ARP table, and *IF* it is present, generates syslog. https://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/ios-xe-16/216091-best-practices-and-useful-scripts-for-ee.html Useful EEM Scripts -> Track Specific MAC Address for MAC Address Learn

THe most probable answer is A: B and C-> Seems there si no such a syslog output to compare with. D - > The check is made in the arp table, not in the mac address-table

D is wrong since it checks ARP table

Answer A seems plausible but it says a syslog message is generated every 600 seconds, reporting the status (exists or not) of the MAC address. But that's not what the script is doing. A syslog message is generated ONLY if the MAC address is found.' I agree with those pointing out that answers B-D are addressing the MAC table, which isn't quite right. It is the ARP table that is checked. But that's Cisco for you. Best fit if you overlook table terminology is answer D.

Tested in GNS3 syslog message is generated only if the specific MAC address is found, it's not generated every 600 seconds. If the MAC isn't found, no syslog message is generated.

Burik is correct, the answer is D.

Answers A and D are splitting hairs to me

B and C are obviously wrong. D seems correct at first glance, but the EEM is reading the ARP table, not the MAC address table A is the only valid answer.