350-401 · Question #729
Refer to the exhibit. Which EEM script generates a critical-level syslog message and saves a copy of the running configuration to the bootflash when an administrator saves the running configuration to
The correct answer is B. action 1.0 cli command "enable". An EEM script can be configured to detect when an administrator saves the running configuration to the startup configuration, subsequently logging a critical syslog message and backing up the running configuration.
Question
Refer to the exhibit. Which EEM script generates a critical-level syslog message and saves a copy of the running configuration to the bootflash when an administrator saves the running configuration to the startup configuration?
Options
- Aaction 1.0 cli command copy running-config bootflash:/current_config.txt
- Baction 1.0 cli command "enable"
- Caction 1.0 cli command copy running-config bootflash:/current_config.txt
- Daction 1.0 cli command "enable"
How the community answered
(71 responses)- A15% (11)
- B72% (51)
- C4% (3)
- D8% (6)
Why each option
An EEM script can be configured to detect when an administrator saves the running configuration to the startup configuration, subsequently logging a critical syslog message and backing up the running configuration.
This action only saves the running configuration to bootflash, but it does not generate a critical-level syslog message as explicitly required by the question.
An EEM applet is configured using `event cli pattern` to trigger specifically when the `copy running-config startup-config` command is executed. The applet then uses `action syslog msg "..." level critical` to generate the required syslog message and `action cli command "copy running-config bootflash:/current_config.txt"` to save a copy of the configuration to bootflash. The provided text for choice 'B' refers to the comprehensive and correct EEM applet that encompasses these actions.
This action only saves the running configuration to bootflash, but it does not generate a critical-level syslog message as explicitly required by the question, and it is a duplicate of option A.
The `action 1.0 cli command "enable"` merely enters privileged EXEC mode and does not perform the required tasks of generating a syslog message or saving the configuration to bootflash.
Concept tested: EEM script configuration for auditing
Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/eem/configuration/15-mt/eem-15-mt-book/eem-cli-event.html
Topics
Community Discussion
No community discussion yet for this question.