300-410 NetFlow and Flexible NetFlow Practice Test 4 — 15 Questions

Question 1

A network engineer runs the following command to verify NetFlow export destination:

R1# show ip flow export

Flow export v9 is enabled for main cache
  Export source and destination details :
  VRF ID : Default
    Destination(1)  192.168.1.100 (2055)
  Source IP         10.0.0.1
  Origin AS         65000
  Peer AS           65001
  Mask for source   255.255.255.255
  Mask for destination 255.255.255.255
  Version 9 flow records
  1234 flows exported in 567 udp datagrams
  0 flows failed due to lack of export packet
  0 export packets were sent up to process level
  0 export packets were dropped due to no fib
  0 export packets were dropped due to adjacency issues
  0 export packets were dropped due to fragmentation failures
  0 export packets were dropped due to encapsulation fixup failures

What does this output indicate?

Accepted Answer

NetFlow export is successful with 1234 flows exported and no errors.. The output shows that NetFlow export is working correctly. It is exporting version 9 flows to destination 192.168.1.100 on port 2055, using source IP 10.0.0.1. There are no failures or drops, indicating successful export.

Answer

NetFlow export is failing due to adjacency issues.

Answer

NetFlow is using version 5 export.

Answer

The export destination is not configured.

Question 2

A network engineer runs the following command to troubleshoot Flexible NetFlow cache usage:

R1# show flow monitor FLOW-MONITOR-1 statistics

Cache type:                               Normal
  Cache size:                                 1000
  Current entries:                             900
  High Watermark:                              950
  Flows added:                               50000
  Flows aged:                                49100
  - Active timeout (  1800 secs):           40000
  - Inactive timeout (   15 secs):           9000
  - Event aged:                               100
  - Watermark aged:                             0
  - Emergency aged:                             0

What does this output indicate?

Accepted Answer

The cache is nearly full, with many long-lived flows causing active timeout aging. No watermark or emergency aging has occurred yet.. The cache is nearly full (900 out of 1000 entries). The high watermark is 950, which is close to the cache size. Most flows are aged due to active timeout (40000), indicating long-lived flows. The cache is under pressure but not yet experiencing watermark or emergency aging.

Answer

The cache is mostly empty and flows are aging normally.

Answer

Emergency aging is occurring because the cache is full.

Answer

Watermark aging has occurred, indicating the cache size needs to be increased.

Question 3

A network engineer runs the following command to verify NetFlow data export format:

R1# show flow exporter EXPORTER-1

Flow Exporter: EXPORTER-1
    Transport Configuration:
      Destination IP address: 192.168.1.100
      Source IP address: 10.0.0.1
      Transport Protocol: UDP
      Destination Port: 2055
      Source Port: 51234
      DSCP: 0x00
      TTL: 255
      Output Features: Used
    Export Protocol: NetFlow Version 9
    Template Data Export Timeout: 1800 seconds
    Option Data Export Timeout: 1800 seconds
    Option Data Configured:
      application-table
      sub-application-table
      application-attributes

What does this output indicate?

Accepted Answer

The exporter is configured to send NetFlow version 9 data with application option data, indicating NBAR integration.. The output shows the configuration of a Flexible NetFlow exporter. It uses UDP to send NetFlow version 9 data to 192.168.1.100 on port 2055. It also exports option data like application tables and attributes, which are used for NBAR-based application recognition.

Answer

The exporter uses TCP to ensure reliable delivery of flow records.

Answer

The exporter is not sending any option data.

Answer

The exporter uses a destination port of 514.

Question 4

A network engineer runs the following command to verify Flexible NetFlow cache entries:

R1# show flow monitor FLOW-MONITOR-1 cache format record

Cache entry for flow 1:
    ipv4 source address: 10.0.0.1
    ipv4 destination address: 192.168.1.100
    ip protocol: 6
    counter bytes: 1500
    counter packets: 10
    timestamp sys-uptime first: 123456
    timestamp sys-uptime last: 123556

Cache entry for flow 2:
    ipv4 source address: 10.0.0.2
    ipv4 destination address: 192.168.1.101
    ip protocol: 17
    counter bytes: 500
    counter packets: 5
    timestamp sys-uptime first: 123457
    timestamp sys-uptime last: 123557

What does this output indicate?

Accepted Answer

The cache shows two flows with source/destination IP, protocol, byte/packet counts, and timestamps.. The output shows two active flows in the Flexible NetFlow cache. Flow 1 is a TCP (protocol 6) flow from 10.0.0.1 to 192.168.1.100 with 1500 bytes and 10 packets. Flow 2 is a UDP (protocol 17) flow from 10.0.0.2 to 192.168.1.101 with 500 bytes and 5 packets. The timestamps show the first and last packet times.

Answer

Both flows are TCP connections.

Answer

The cache does not include protocol information.

Answer

The flows are being exported immediately.

Question 5

A network engineer runs the following command to debug Flexible NetFlow cache events:

R1# debug flow monitor FLOW-MONITOR-1

Flow Monitor FLOW-MONITOR-1 debugging is on
R1#
*Mar  1 00:10:15.123: FLOW MONITOR: Cache entry created for flow 10.0.0.1:1234 -> 192.168.1.100:80 (TCP)
*Mar  1 00:10:15.124: FLOW MONITOR: Cache entry updated for flow 10.0.0.1:1234 -> 192.168.1.100:80 (TCP) - bytes: 1460, packets: 1
*Mar  1 00:10:15.125: FLOW MONITOR: Cache entry updated for flow 10.0.0.1:1234 -> 192.168.1.100:80 (TCP) - bytes: 2920, packets: 2
*Mar  1 00:10:45.123: FLOW MONITOR: Cache entry aged for flow 10.0.0.1:1234 -> 192.168.1.100:80 (TCP) - reason: inactive timeout

What does this output indicate?

Accepted Answer

The flow was created, updated twice, and then aged due to inactive timeout, indicating a normal flow lifecycle.. The debug output shows the lifecycle of a flow in the Flexible NetFlow cache. A flow is created, then updated as packets are received, and eventually aged out due to inactive timeout after 30 seconds of inactivity (the default is 15 seconds, but this may be configured differently). This is normal behavior for a TCP connection that has ended.

Answer

The flow was aged due to active timeout after 1800 seconds.

Answer

The flow was dropped because the cache was full.

Answer

The flow is still active in the cache.

Question 6

What is the default flow-cache timeout for NetFlow version 9 on Cisco IOS-XE?

Accepted Answer

30 minutes. The default flow-cache timeout for NetFlow version 9 is 30 minutes, after which inactive flows are aged out.

Answer

15 minutes

Answer

60 minutes

Answer

5 minutes

Question 7

Which statement correctly describes the default behavior of the 'flow monitor' in Flexible NetFlow regarding the collection of BGP next-hop information?

Accepted Answer

BGP next-hop is collected only if the flow record includes the 'match routing bgp next-hop' command.. By default, Flexible NetFlow does not collect BGP next-hop information unless explicitly configured in the flow record.

Answer

BGP next-hop is always collected by default in Flexible NetFlow monitors.

Answer

BGP next-hop is never collected in Flexible NetFlow, only in traditional NetFlow.

Answer

BGP next-hop is collected by default only for IPv4 flows.

Question 8

What is the default export interval for NetFlow data when using the 'flow exporter' with UDP as the transport protocol?

Accepted Answer

Exports are triggered by flow aging or cache fullness, not a fixed interval.. The default export interval is based on flow cache timeout; there is no fixed interval—exports occur when flows age out or cache is full.

Answer

Every 60 seconds

Answer

Every 30 seconds

Answer

Every 10 seconds

Question 9

Which of the following is a mandatory field in a Flexible NetFlow flow record for IPv4 traffic?

Accepted Answer

Source IP address. The source IP address is a mandatory field in any IPv4 flow record; other fields like destination port are optional.

Answer

Destination port

Answer

Protocol type

Answer

TCP flags

Question 10

What is the default value for the 'active flow timeout' in a Flexible NetFlow monitor on Cisco IOS-XE?

Accepted Answer

30 minutes. The default active flow timeout is 30 minutes, after which long-lived flows are exported regardless of activity.

Answer

15 minutes

Answer

60 minutes

Answer

5 minutes

Question 11

Which NetFlow version introduced the concept of templates to support variable-length flow records?

Accepted Answer

NetFlow version 9. NetFlow version 9 introduced templates, allowing flexible and extensible flow record formats.

Answer

NetFlow version 5

Answer

NetFlow version 8

Answer

NetFlow version 10 (IPFIX)

Question 12

In Flexible NetFlow, what is the default 'collect counter bytes' setting for a flow record?

Accepted Answer

Byte counters are collected only if the flow monitor includes the 'collect counter bytes' command.. By default, byte counters are not collected unless explicitly configured with 'collect counter bytes' in the flow record.

Answer

Byte counters are collected by default.

Answer

Byte counters are never collected in Flexible NetFlow.

Answer

Byte counters are collected by default only for IPv6 flows.

Question 13

What is the default transport protocol used by NetFlow exporters on Cisco IOS-XE?

Accepted Answer

UDP. The default transport protocol is UDP, typically on port 2055, though configurable.

Answer

TCP

Answer

SCTP

Answer

ICMP

Question 14

Which statement correctly describes the default 'match' direction in a Flexible NetFlow flow record?

Accepted Answer

The default match direction is 'input' (ingress).. The default match direction is 'input' (ingress), meaning flows are matched on incoming traffic only.

Answer

The default match direction is 'output' (egress).

Answer

The default match direction is 'both' (input and output).

Answer

There is no default direction; it must always be specified.

Question 15

Drag and drop the steps to configure Flexible NetFlow with a custom flow record into the correct order, from first to last.

Accepted Answer

Define flow record with match ipv4 source address. The correct order follows Cisco IOS-XE configuration logic: first define the flow record with match fields, then define the flow exporter with destination and source, then define the flow monitor binding record and exporter, then apply the monitor to an interface in the ingress direction, and finally verify with 'show flow monitor'.