Which EEM Script Sends SNMP Trap and Critical Syslog for Config Mode?
Refer to the exhibit. A network engineer must be notified when a user switches to configuration mode. Which script should be applied to receive an SNMP trap and a critical-level log message? - 
Community Votes
100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests whether you know that an EEM applet can send an SNMP trap and generate a critical syslog message using two separate actions, and the common trap is forgetting the syslog priority critical statement.
Learn how to configure an EEM applet that notifies engineers with an SNMP trap and a critical-level syslog when a user enters configuration mode. Community consensus confirms the correct script uses both action 1.0 and action 1.1 with proper sequencing.
Choosing an option that only sends the SNMP trap but omits the critical-level syslog action (or uses a non-critical priority), since many candidates miss the need for the syslog priority critical line.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option C is correct because it includes both required actions: action 1.0 snmp-trap strdata "Configuration change alarm" sends the SNMP trap, and action 1.1 syslog priority critical msg "Configuration change alarm" logs the message at critical severity. This matches the requirement to notify the engineer via SNMP and generate a critical-level log.
The community comments confirm this sequence. One comment explains that action 1.0 handles the SNMP trap while action 1.1 handles the syslog message with priority critical. Another comment explicitly lists both actions and explains their purpose.
Without the syslog action, only half the requirement is met. The wording of the question demands both notifications, so any option lacking syslog priority critical is incomplete.
Why the Other Options Are Wrong
Options A and B appear to contain only the snmp-trap action without the critical syslog action. Since the question specifies both an SNMP trap and a critical-level log message, these options fail the requirement.
Option D uses the text "Configuration change critical alarm" in the snmp-trap string. While it includes the word critical, it does not necessarily include the syslog priority critical action either. The syslog priority must be set to critical through the priority critical keyword, not just by including the word in the message string.
If any option had the same text as C but with priority informational or priority warnings, it would also be wrong because the question specifically asks for a critical-level log message.
Community Comment Notes
Comment [1] states that the correct answer is C and explains that the script should include both actions properly sequenced. It also provides the exact script lines, matching our analysis.
Comment [2] explicitly writes out the two actions and explains what each does: the SNMP trap sends the message, and the syslog logs it with critical severity. This aligns with the exam's intent.
Comment [3] breaks down the requirement into two parts: SNMP trap via snmp-trap strdata and critical log via priority critical msg. This concise summary is useful for quick recall during the exam.
Official Reference
Exam Strategy
When solving EEM script questions, read the requirement carefully and map each action item to a specific EEM command. Remember that sending an SNMP trap requires snmp-trap strdata, while logging requires syslog priority <severity> msg <text>. Always verify both actions are present and correctly ordered.
Related Analysis
Practice All 350-401 Questions
Access 218 questions with complete answers and detailed explanations.
View Full 350-401 Practice Test →