How to Block Configuration Mode Using Cisco EEM Applets?

Refer to the exhibit. An engineer constructs an EEM applet to prevent anyone from entering configuration mode on a switch. Which snippet is required to complete the EEM applet? - image

  1. sync yes skip yes
  2. sync no skip yes Source Reference Answer
  3. sync no skip no
  4. sync yes skip no

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

It tests precise knowledge of EEM execution timing and parameter validity, with the common trap being the misconception that 'sync yes' can be paired with 'skip' to control command execution.

This question evaluates the correct configuration of Cisco Embedded Event Manager (EEM) applets to intercept and block specific CLI commands. Community consensus strongly supports 'sync no skip yes' as the required syntax to asynchronously trigger the applet and prevent the original command from executing.

Candidates frequently select 'sync yes skip no' or 'sync yes skip yes', incorrectly assuming synchronous execution allows the applet to gatekeep the CLI command, when in reality 'sync yes' does not support the 'skip' parameter and executes differently.

Community Discussion (9 comments)

Aaron_0801 👍 14 Selected: B
Provided answer is correct. The "sync no" option tells the script to run before the CLI command is executed. This means that this applet is executed before the actual "configure terminal" CLI command is executed. This gives you the opportunity to choose what to do after the applet is run. Since "skip yes" is indicated, the "configure terminal" CLI command is skipped completely and is replaced by the actions of the script.
chmacnp 👍 1 Selected: B
B - another example and use case for sync no skip yes event manager applet NoReload event cli pattern "reload" sync no <------The EEM script intercepts the command skip yes <------ skips the CLI command from running at all action 1.0 syslog priority errors msg "Cannot reload this router" sync yes - would you be used to run the CLI command once the EEM script has completed successfully, enabling additional checks and control over the operation
zbeugene7 👍 1
It can't be C or D because skip no = comand would run and we don't want it to, it should be skip yes for the command not to run. It should be sync = yes for EEM script to run and apply the skip, so the answer is A: sync yes skip yes: run applet do not run command
AbdullahMohammad251 👍 1 Selected: B
Options A and D are incorrect. Sync "yes" doesn't have the skip option, because both the CLI command and the EEM script will run simultaneously. C. Incorrect, the CLI command will be executed after the EEM script ("skip" is set to no.) B. Correct! Sync "no" does have the "skip" option, because they are run asynchronously (not at the same time.) The EEM script will run first, and then we can decide whether or not to run the CLI command that triggered the event. "skip" yes means, the CLI command will be skipped (not executed,) whenever it is entered on the terminal.
16561f6 👍 1
D. sync yes skip no Explanation: sync yes: This ensures that the EEM applet will wait for the command to complete before continuing with the next steps, providing synchronous behavior. skip no: This prevents the execution of the command (in this case, entering configuration mode) when the EEM applet is triggered.
slacker_at_work 👍 3 Selected: B
I don't even have the skip option when using sync yes: R2(config)#event manager applet Config R2(config-applet)#event cli pattern "configure terminal" sync yes ? default Default action timer maxrun Maximum runtime of applet occurs The number of occurrences before raising the event period Number of occurrences must occur within this time period <cr>
Mistwalker 👍 3 Selected: B
B is correct. sync no = run the EEM applet first (asynchronously i.e. ahead of the CLI command) skip yes = skip (don't run) the CLI command after the EEM applet is done "The sync no option tells the script to run before the CLI command is executed. This means that this applet is executed before the actual CLI command is executed. This gives you the opportunity to choose what to do after the applet is run. Since skip yes is indicated, the CLI command is skipped completely and is replaced by the actions of the script." https://notes.networklessons.com/eem-sync-and-skip-keywords
teems5uk 👍 1 Selected: C
C. seems better
Mizuchan 👍 1 Selected: C
To prevent anyone from entering configuration mode on a switch using the provided EEM applet, you would want to ensure that the applet does not synchronize with other applets (sync no) and that it does not skip subsequent statements if the current one fails (skip no). Therefore, the correct option for the snippet to complete the EEM applet is: C. sync no skip no

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

EEM Command Interception Fundamentals

Cisco Embedded Event Manager (EEM) allows administrators to automate responses to system events, including CLI command triggers. To prevent users from entering configuration mode via configure terminal, an EEM applet must intercept the command before it reaches the CLI parser.

Decoding the Syntax Parameters

The critical piece missing in the exhibit is the synchronization and skipping directive appended to the event cli pattern line:
  • sync no: Configures the applet to run asynchronously ahead of the matched CLI command. This ensures the EEM script executes first, giving it the opportunity to log messages, send alerts, or modify state before the original command proceeds.
  • skip yes: Explicitly instructs the router/switch to discard the original CLI command after the EEM applet finishes. Without this flag, the command would still execute regardless of the applet's actions.

Why Option B is Correct

Option B (sync no skip yes) is the only valid combination that achieves the stated goal. As noted by community experts, sync no guarantees the applet runs first, and skip yes actively blocks configure terminal from ever taking effect. This pair is specifically designed for command interception and policy enforcement.

Why the Other Options Fail

  • Option A & D (sync yes ...): The sync yes parameter changes the execution model entirely. It typically waits for the CLI command to complete or runs concurrently, and critically, IOS does not support the skip keyword when sync yes is configured. Attempting this in a real device will result in a syntax error.
  • Option C (sync no skip no): While sync no correctly prioritizes the applet, skip no tells the system to proceed with the original CLI command afterward. This defeats the entire purpose of blocking configuration mode.
As highlighted in candidate discussions, mastering the distinction between synchronous and asynchronous EEM execution is essential for troubleshooting and designing automated security policies.

Official Reference

Exam Strategy

When answering EEM applet questions, always map the business requirement to execution timing first. If the goal is to intercept or block a command, immediately look for 'sync no skip yes'; if the goal is to run additional tasks after a command succeeds, use 'sync no skip no'. Always verify parameter compatibility, as IOS restricts certain flags based on the sync setting.

Related Analysis

Refer to the exhibit. An engineer attempts to configure stan

A-Grade

Refer to the exhibit. An engineer must configure router R1 t

A-Grade

Refer to the exhibit. Which action must be taken to configur

A-Grade

Practice All 350-401 Questions

Access 218 questions with complete answers and detailed explanations.

View Full 350-401 Practice Test →

← Back to 350-401 Study Guide