300-410 NetFlow and Flexible NetFlow Practice Test 2 — 15 Questions

Question 1

A network engineer runs the following command on Router R1:

R1# show flow interface GigabitEthernet0/1

Interface GigabitEthernet0/1
  FNF: monitor
    Monitor: FLOW-MONITOR-1
      direction: Input
      traffic-statistics:  enabled

Based on this output, what can be concluded?

Accepted Answer

The flow monitor is applied only to incoming traffic on this interface.. The output shows that flow monitor FLOW-MONITOR-1 is applied to GigabitEthernet0/1 in the input direction with traffic statistics enabled.

Answer

The flow monitor is applied to both input and output traffic.

Answer

Traffic statistics are disabled.

Answer

The flow monitor is not attached to any interface.

Question 2

A network engineer runs the following command on Router R1:

R1# show flow monitor FLOW-MONITOR-1 cache format table

Cache type:                               Normal
Cache size:                               1000
Current entries:                          0
High Watermark:                           0

Flows added:                              0
Flows aged:                               0
  - Active timeout (1800 secs)           0
  - Inactive timeout (15 secs)           0
  - Event aged                           0
  - Watermark aged                       0
  - Emergency aged                       0

R1# show flow interface GigabitEthernet0/1

Interface GigabitEthernet0/1
  FNF: monitor
    Monitor: FLOW-MONITOR-1
      direction: Input
      traffic-statistics:  enabled

Based on both outputs, what is the most likely problem?

Accepted Answer

The flow monitor is attached, but no traffic is flowing through the interface.. The flow monitor is attached to the interface, but the cache shows 0 flows added. This suggests that no traffic is being received on that interface, or the flow record does not match any packets (e.g., record type mismatch).

Answer

The flow monitor is not attached to the interface.

Answer

The cache size is too small.

Answer

The flow exporter is misconfigured.

Question 3

A network engineer runs the following command on Router R1:

R1# show flow exporter EXPORTER-1

Flow Exporter EXPORTER-1:
  Description: Exports to collector
  Export protocol: NetFlow Version 9
  Transport Configuration:
    Destination IP address: 192.168.1.100
    Source IP address: 10.0.0.1
    Transport Protocol: UDP
    Destination Port: 2055
    Source Port: 0
  Collector Configuration:
    VRFs:
      Default
  Options Configuration:
    Sampler: Not configured
  Export Statistics:
    Number of Flows exported: 5000
    Number of Packets exported: 250
    Number of Source IP address unreachable: 10
    Number of Packets dropped: 0

Based on this output, what is the most likely issue?

Accepted Answer

The source IP address 10.0.0.1 is not reachable from the destination, causing some packets to fail.. The exporter has exported flows, but there are 10 Source IP address unreachable errors. This indicates that the source IP address (10.0.0.1) is not reachable from the destination at times, possibly due to routing issues or interface flapping.

Answer

The destination IP address is unreachable.

Answer

The UDP port 2055 is blocked.

Answer

The exporter is not sending any packets.

Question 4

Examine the following partial configuration on router R1:

flow record RECORD-1
 match ipv4 source address
 match ipv4 destination address
 match ipv4 protocol
 collect counter bytes
 collect counter packets
!
flow monitor MONITOR-1
 record RECORD-1
 cache timeout active 60
!
interface GigabitEthernet0/1
 ip flow monitor MONITOR-1 input
!

Which statement about this configuration is true?

Accepted Answer

The flow monitor will export flow records every 60 seconds regardless of whether the flow is still active.. This question tests understanding of Flexible NetFlow configuration components and the effect of the cache timeout active command.

Answer

The flow monitor will only export flows that have been idle for 60 seconds.

Answer

The flow record is missing the 'collect transport tcp-flags' command to be valid.

Answer

The flow monitor will not export any data because no exporter has been configured.

Question 5

Consider the following partial configuration on router R2:

flow exporter EXPORTER-1
 destination 192.168.1.100
 source Loopback0
 transport udp 2055
!
flow monitor MONITOR-2
 exporter EXPORTER-1
 record netflow ipv4 original-input
 cache timeout active 30
!
interface GigabitEthernet0/2
 ip flow monitor MONITOR-2 input
!

What is the effect of this configuration?

Accepted Answer

The router will export NetFlow version 9 records containing IPv4 source and destination addresses, protocol, and packet/byte counts.. This question tests knowledge of the 'record netflow ipv4 original-input' predefined record and its behavior.

Answer

The router will export NetFlow version 5 records because the exporter uses UDP port 2055.

Answer

The flow monitor will only collect traffic on the input direction of GigabitEthernet0/2, but no export will occur because the exporter is not applied to the monitor.

Answer

The flow monitor will export flows every 30 seconds only if the flow is idle for that period.

Question 6

Examine this partial configuration on router R3:

flow record RECORD-2
 match ipv4 source address
 match ipv4 destination address
 match ipv4 protocol
 match transport source-port
 match transport destination-port
 collect counter bytes
 collect counter packets
!
flow monitor MONITOR-3
 record RECORD-2
 cache timeout active 60
 cache timeout inactive 15
!
interface GigabitEthernet0/3
 ip flow monitor MONITOR-3 input
 ip flow monitor MONITOR-3 output
!

Which statement is true about this configuration?

Accepted Answer

The router will create separate flow records for traffic entering and leaving GigabitEthernet0/3, doubling the cache entries.. This question tests understanding of bidirectional flow monitoring and cache timeout interaction.

Answer

The router will aggregate input and output flows into a single cache entry for each unique flow.

Answer

The inactive timeout of 15 seconds will cause flows to be exported only after 15 seconds of inactivity, overriding the active timeout.

Answer

The configuration is invalid because a flow monitor cannot be applied to both input and output on the same interface.

Question 7

Consider the following partial configuration on router R4:

flow exporter EXPORTER-2
 destination 10.10.10.1
 source Loopback0
 transport udp 9996
 option interface-table
 option sampler-table
!
flow monitor MONITOR-4
 exporter EXPORTER-2
 record netflow ipv4 original-input
!
interface GigabitEthernet0/4
 ip flow monitor MONITOR-4 input
!

What is the purpose of the 'option interface-table' and 'option sampler-table' commands under the exporter?

Accepted Answer

They instruct the router to periodically export metadata about interfaces and samplers to the collector, aiding in data interpretation.. This question tests knowledge of option templates in Flexible NetFlow exporters.

Answer

They enable the router to sample traffic based on interface and sampler tables before exporting.

Answer

They limit the export to only interface and sampler statistics, ignoring flow records.

Answer

They are required for the exporter to function; without them, no data is exported.

Question 8

Examine this partial configuration on router R5:

flow record RECORD-3
 match ipv4 source address
 match ipv4 destination address
 match ipv4 protocol
 collect routing source as
 collect routing destination as
!
flow monitor MONITOR-5
 record RECORD-3
 cache timeout active 60
!
interface GigabitEthernet0/5
 ip flow monitor MONITOR-5 input
!

What is missing or incorrect in this configuration?

Accepted Answer

The router must have BGP configured and the flow record must include 'match ipv4 bgp source-as' and 'match ipv4 bgp destination-as' to collect AS numbers.. This question tests knowledge of BGP AS number collection requirements in Flexible NetFlow.

Answer

The flow record is missing 'match ipv4 source prefix-length' and 'match ipv4 destination prefix-length' to collect AS numbers.

Answer

The flow monitor is missing the 'cache timeout inactive' command to properly age out flows.

Answer

The configuration is correct; AS numbers will be collected automatically from the routing table.

Question 9

Consider the following partial configuration on router R6:

flow exporter EXPORTER-3
 destination 192.168.2.200
 source Loopback0
 transport udp 2055
 template data timeout 120
!
flow monitor MONITOR-6
 exporter EXPORTER-3
 record netflow ipv4 original-input
!
interface GigabitEthernet0/6
 ip flow monitor MONITOR-6 input
!

What is the effect of the 'template data timeout 120' command?

Accepted Answer

The router will resend the NetFlow v9 template to the collector every 120 seconds to ensure the collector has the latest template.. This question tests understanding of template refresh timing in NetFlow v9 export.

Answer

The router will wait 120 seconds before sending any flow data after the first template is sent.

Answer

The router will export flow data only if the template has been successfully acknowledged by the collector within 120 seconds.

Answer

The router will store flow data for 120 seconds before exporting to allow batching.

Question 10

What is the default active flow timeout value in Cisco IOS Flexible NetFlow?

Accepted Answer

1800 seconds. This question tests recall of default timer values in Flexible NetFlow.

Answer

60 seconds

Answer

300 seconds

Answer

30 seconds

Question 11

In Flexible NetFlow, which of the following is true regarding the 'match' and 'collect' commands in a flow record?

Accepted Answer

The 'match' command defines fields that are used to identify unique flows, while 'collect' defines additional fields to include in the exported record.. This question tests understanding of the difference between match and collect in flow record definition.

Answer

Both 'match' and 'collect' define key fields; the difference is that 'match' fields are required and 'collect' fields are optional.

Answer

The 'match' command is used for input flows, and 'collect' is used for output flows.

Answer

The 'collect' command is used to aggregate flows, while 'match' is used to filter them.

Question 12

Which NetFlow version is the default export format when using Flexible NetFlow with the 'record netflow ipv4 original-input' command?

Accepted Answer

NetFlow version 9. This question tests knowledge of the default export version for Flexible NetFlow predefined records.

Answer

NetFlow version 5

Answer

IPFIX (NetFlow version 10)

Answer

NetFlow version 1

Question 13

Which TWO commands would a network engineer use to verify NetFlow data export and flow monitor statistics on a Cisco IOS-XE router? (Choose TWO.)

Accepted Answer

show flow monitor name FLOW-MON cache. The 'show flow monitor name <name> cache' command displays detailed flow cache entries for a specific Flexible NetFlow monitor, including packet/byte counts and timestamps. The 'show ip cache flow' command is the traditional way to verify NetFlow statistics and export status. Option C ('show ip flow export') is plausible but shows only export parameters, not cache data. Option D is a debug command not used for verification. Option E is for SNMP, not NetFlow.

Answer

show ip flow export

Answer

debug ip flow export

Answer

show snmp mib ifmib ifindex

Question 14

Which TWO statements about Flexible NetFlow flow records are true? (Choose TWO.)

Accepted Answer

A flow record defines which fields are matched (key fields) and which fields are collected (non-key fields).. Flexible NetFlow allows user-defined flow records that can match on Layer 2, 3, and 4 fields, such as MAC addresses, IP addresses, and TCP/UDP ports. Additionally, flow records can collect non-key fields like packet and byte counts, timestamps, and interface counters. Option B is false because Flexible NetFlow can also match on Layer 2 fields. Option C is false because flow records can include both key and non-key fields. Option E is false because Flexible NetFlow records are not limited to IPv4; they can also support IPv6 and MPLS.

Answer

Flexible NetFlow flow records can only match on Layer 3 and Layer 4 fields.

Answer

A flow record must contain at least one key field and cannot contain non-key fields.

Answer

Flexible NetFlow flow records are only supported for IPv4 traffic.

Question 15

Which TWO configuration steps are required to enable Flexible NetFlow on a Cisco IOS-XE interface? (Choose TWO.)

Accepted Answer

Create a flow record using 'flow record '.. To enable Flexible NetFlow, you must first create a flow record (defining key and non-key fields) and a flow monitor (which references the flow record and export parameters). Then, you apply the flow monitor to the interface in the appropriate direction (input or output) using the 'ip flow monitor [input|output]' command. Option B is incorrect because the flow exporter is configured separately, not as part of the flow monitor. Option C is incorrect because the 'ip route-cache flow' command is used for traditional NetFlow, not Flexible NetFlow. Option E is incorrect because the flow monitor is applied directly to the interface, not through a class-map.

Answer

Enable 'ip route-cache flow' on the interface.

Answer

Configure a class-map and policy-map to apply the flow monitor.