EEM & Model-Driven Telemetry Practice Questions

Answers and explanations appear when you work through the set above.

1. Which EEM statement syntax executes an IOS CLI command inside an Embedded Event Manager applet policy?

   • action 1.0 cli command "show ip interface brief"
   • event cli pattern "show ip interface brief"
   • trigger cli execution "show ip interface brief"
   • action 1.0 exec-command "show ip interface brief"

2. What distinguishes an on-change telemetry subscription from a periodic telemetry subscription?

   • Updates are sent only when the value changes, instead of at a fixed interval.
   • On-change subscriptions require the collector to poll the device every 30 seconds over SNMP.
   • Periodic subscriptions must use UDP port 514, the syslog port, as their transport.
   • On-change subscriptions are limited to hardware sensors such as temperature and fans.

3. In Cisco IOS EEM, which event detector triggers an automated applet when a matching syslog log message appears in the device logging queue?

   • event timer watchdog time 60
   • event syslog pattern "LINK-3-UPDOWN"
   • event track 1 state down
   • event cli pattern "configure terminal"

4. Why is a Dial-Out model-driven telemetry architecture generally preferred over traditional SNMP polling in large-scale enterprise automation?

   • The device opens a persistent outbound session (such as gRPC) and streams data without polling.
   • Dial-out requires an engineer to run an interactive CLI command on each device every 5 minutes.
   • Dial-out removes all transport security, so no certificates or credentials have to be managed.
   • Each collector must issue GET requests to every interface on every device once per second.

5. What data modeling language does Cisco model-driven telemetry use to structure the operational and configuration data exposed by a device?

   • YANG
   • XML Schema Definition (XSD) only
   • SNMP MIB-II exclusively
   • JSON Schema draft-07

6. In an EEM applet, which command block section defines the condition that must occur before the applet's actions execute?

   • The action section
   • The event section
   • The trigger correlation section
   • The class-map section

7. Which EEM event detector allows an applet to fire based on a change in the state of an Enhanced Object Tracking (EOT) object, such as an interface or route reachability track going down?

   • event track
   • event resource
   • event routing
   • event counter

8. What is a key operational advantage of streaming telemetry over traditional SNMP polling when monitoring dozens of interface counters across hundreds of devices?

   • It needs more CPU on the collector than SNMP GET polling does, which in turn makes the counters more accurate.
   • The device pushes structured updates itself, so the collector no longer polls each counter with GETs.
   • It runs only over IPv4 transport, while SNMP polling can also run over IPv6 transport.
   • It cannot be filtered by sensor path, so each update is a full dump of every device counter.

9. Which transport protocol is most commonly paired with model-driven telemetry on Cisco IOS XE for dial-out streaming to a collector?

   • gRPC
   • SMTP
   • FTP
   • Telnet

10. Which EEM applet action is used to send an email or a syslog message when the applet's trigger condition is met, without requiring an external scripting engine?

    • action <label> syslog msg "<text>" or action <label> mail
    • action <label> reload
    • action <label> cli command "copy running-config startup-config"
    • action <label> counter name <name> op set value 0

11. In model-driven telemetry, what does a sensor path or subscription path define?

    • The physical cabling route from the device to the collector, recorded so that path redundancy can be planned.
    • The YANG data node (such as an interface counters container) that the subscription streams.
    • The IGP metric the device uses to reach the collector over the management network.
    • The QoS class and DSCP marking assigned to gRPC packets sent to the collector.

12. What is the functional difference between EEM's event manager applet and event manager policy Tcl-based configurations?

    • Applets can match syslog events but not SNMP events, while Tcl policies can match SNMP events but not syslog.
    • Applets are event/action lists entered in the CLI; Tcl policies are script files with the full Tcl language and libraries.
    • Tcl policies cannot read any router state information, so they can only send syslog messages and email notifications.
    • Applets need an external Python interpreter on the device, while Tcl policies run natively in IOS.

13. Why might an operator prefer periodic telemetry subscriptions over on-change subscriptions for a metric such as interface byte counters used for capacity trending?

    • Periodic subscriptions are the only kind that can be sent over gRPC dial-out to a collector.
    • Byte counters change almost constantly, so on-change suits them poorly (and is often unsupported); periodic gives regular samples.
    • On-change subscriptions take much longer to configure than periodic ones, because each one needs its own EEM applet.
    • Periodic subscriptions use less bandwidth than on-change subscriptions regardless of how often the underlying data changes.

14. Which IOS XE command shows a log of recent EEM applet and policy executions, so you can confirm whether an applet actually fired?

    • show event manager history events
    • show event manager detector all
    • show event manager policy available
    • show archive log config all