This one is tricky. Please, pay attention to the wordings. With the command “show ip arp | in 0005.4278.9866”, the “ARPR” text is only found if this MAC address has been learned in the router. Answer A is not correct as the syslog message is only generated if the specific MAC address is found (not every 600 seconds).

It's D. The ARP table is checked every 600 seconds, but the syslog message is generated only if the specific MAC address is found, it's not generated every 600 seconds. If the MAC isn't found, no syslog message is generated. if $_regexp_result eq 1 <-- if the MAC is found... syslog msg $_cli_result <-- ...then generate a syslog entry, otherwise do nothing

It's A Read Engish. It generates a syslog message. None of the other answers say that. and action 7 generates a syslog message. I tested this in my lab. D does NOT check a mac address table, it checks the arp table.

Tested in GNS3 syslog message is generated only if the specific MAC address is found, it's not generated every 600 seconds. If the MAC isn't found, no syslog message is generated.

I'm not an applet expert but for what I can understand the script generate a syslog message every 600s ONLY if the MAC Address: 0005.4319.7489 is in the ARP table. For this reason I would exclude A. B and C are wrong because It doesn't compare a syslog output. D It isn't completely correct but seems OK to me... It checks the *ARP table... My €0.02

A. It DOESN'T generate a syslog message every 600 seconds - if only MAC exists B. it DOESN'T It compare syslog output- it compares cli output C. It DOESN'T compare syslog output - it compares cli output D. It DOESN'T check the MAC address table - it checks ARP

Poorly described ansers :( None is correct. It does not *generete every 600 seconds*, it *checks every 600 seconds* if the MAC address is present in ARP table, and *IF* it is present, generates syslog. https://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/ios-xe-16/216091-best-practices-and-useful-scripts-for-ee.html Useful EEM Scripts -> Track Specific MAC Address for MAC Address Learn

Answer A seems plausible but it says a syslog message is generated every 600 seconds, reporting the status (exists or not) of the MAC address. But that's not what the script is doing. A syslog message is generated ONLY if the MAC address is found.' I agree with those pointing out that answers B-D are addressing the MAC table, which isn't quite right. It is the ARP table that is checked. But that's Cisco for you. Best fit if you overlook table terminology is answer D.

Burik is correct, the answer is D.

Answers A and D are splitting hairs to me

B and C are obviously wrong. D seems correct at first glance, but the EEM is reading the ARP table, not the MAC address table A is the only valid answer.

D is more accurate as it describes the regular checking behavior without implying that a syslog message is always generated. A is incorrect because the applet will only send a syslog message if the specified MAC address is found in the ARP table, not every 600 sec. If the MAC address is not present in the ARP table, the syslog message will not be generated, but the applet will continue to check every 600 seconds.

The EEM applet checks the ARP table every 10 minutes for a specific MAC address. If an ARP entry is found for that MAC address, it logs the entire line containing that ARP entry to the syslog server. This could be used for monitoring when a specific device (identified by its MAC address) is active on the network and logging its IP address assignments over time.

The correct answers are A and D. This question should have a (choose two) options answer. They must have forgotten to say, "choose two". The EEM script does A and D.

THe most probable answer is A: B and C-> Seems there si no such a syslog output to compare with. D - > The check is made in the arp table, not in the mac address-table

D is wrong since it checks ARP table

The question is based on this: https://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/ios-xe-16/216091-best-practices-and-useful-scripts-for-ee.html "Useful EEM Scripts Track Specific MAC Address for MAC Address Learn ... If the MAC is seen, the script takes these actions: outputs a syslog message" syslog msg $_cli_result => display syslog message if MAC is found, so answer A) as others concluded in earlier posts.