This is the correct explanation of why A is the correct answer:
There are 4 options, but only 2 has "FULL to DOWN" which is what we are tying to catch. Out of these two only A begin the script with "enable" which is required in EEM because the applet assumes that the user is in EXEC mode, not privileged EXEC or config mode.
I also noticed once you get down to choices A or C (from the "FULL to DOWN" string), one has the log code of "OSPF-5" and one has it as "OSPF-1". From that, I know OSPF Adjacency change is not a severity level 1, it's a level 5, so at that point it seemed clear cut that the answer was A and not C.
In OSPF logs:
'LOADING to FULL' - this message means that the neighbor relationship has been fully established.
'FULL to DOWN' - neighbor adjacency has been shut down
We need to enable OSPF debugging when the neighbor relationship goes down.
STEPS:
(1) Create an EEM applet named 'ENABLE_OSPF_DEBUG'
(2) Define the event criteria that trigger the applet to run: 'FULL to DOWN' Syslog message shows up
(3) Actions to be taken when the event is triggered: Enabling OSPF debugging for both OSPF events and OSPF adjacency events:
Enter privilege exec mode ---> 'enable'
Enable debugging for ospf events ----> 'debug ip ospf events'
Enable debugging for ospf adjacency events ----> 'debug ip ospf adj'
https://www.ciscopress.com/articles/article.asp?p=3100057&seqNum=4#:~:text=An%20EEM%20policy%20is%20an,that%20is%20written%20in%20Tcl.
A is correct
event manager applet ENABLE_OSPF_DEBUG
event syslog pattern "%OSPF-5-ADJCHG: Process 6, Nbr 1.1.1.1 on Serial0/0 from FULL to DOWN"
action 1.0 cli command "enable"
action 2.0 cli command "debug ip ospf event"
action 3.0 cli command "debug ip ospf adj"
action 4.0 syslog priority informational msg "ENABLE_OSPF_DEBUG"
Keywords:
%OSPF-5-ADJCHG = 5 for Notifications
from FULL to DOWN
action 1.0 cli command "enable"
as mentioned its A reason : when ospf neighboring is down its "from FULL to DOWN"
and shows as Notification message (%OSPF-5-ADJCHG) and yes the script has to go to enable then enters privilege's mode to execute those commands.
Guys, other then the technicalities of OSPF, I took this question with the different prospect.
6 is the informational debug msgs right ??
I went with it straight, is that wrong ?
debug is 7, informational is 6 (default). it sending a syslog message of priority level 6.
https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/eem/command/eem-cr-book/eem-cr-a2.html
Only A&D enable a debug based on earlier events. So B&C are definitely wrong. Between A and D: A also mentions the OSPF neighborship going down, which D doesn't. So the correct answer here is A
A is correct
https://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/ios-xe-16/216091-best-practices-and-useful-scripts-for-ee.html
upvoted 1 times
...
This section is not available anymore. Please use the main Exam Page.350-401 Exam Questions
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
x3rox
Highly Voted 2 years, 3 months agoa197cbf
10 months, 2 weeks agoAbdullahMohammad251
Most Recent 8 months, 1 week ago[Removed]
11 months, 1 week agoZanaRock23
1 year, 1 month agomyhdtv6
1 year, 9 months agoCCAL
1 year, 2 months agoALOVEVIKS
1 year, 11 months agorobi1020
2 years, 4 months agoRaipen24
2 years, 5 months agoHungarianDish_111
2 years, 1 month agoTacolicious
2 years, 5 months agoonkel_andi
2 years, 7 months ago