Practice 350-401 NetFlow and Telemetry questions with full explanations on every answer.
Start practicing
NetFlow and Telemetry — choose a session length
Free · No account required
Click any question to see the full explanation and answer options, or start a focused practice session above.
A network engineer is troubleshooting intermittent packet loss on a WAN link connecting two data centers. The engineer suspects that certain traffic types are being dropped but needs to confirm this without impacting production. The engineer has access to Cisco IOS-XE routers at both ends. Which approach should the engineer use to identify the specific flows being dropped?
2A large enterprise is migrating from traditional SNMP-based monitoring to streaming telemetry for better scalability and real-time visibility. The network team has Cisco Nexus 9000 switches running NX-OS. They want to stream interface counters and BGP neighbor state changes to a collector. Which telemetry technology should they implement?
3A network engineer is configuring NetFlow on a Cisco ISR 4451 router to analyze traffic patterns. The engineer wants to export flow data to a collector every 60 seconds. After applying the configuration, the engineer notices that the export packets are not reaching the collector. The collector is reachable via ICMP. What is the most likely cause?
4A service provider is using Cisco ASR 9000 routers and needs to collect NetFlow data from multiple customers' traffic. The engineer wants to ensure that flow records from different customers are not mixed and can be identified separately. The router supports Flexible NetFlow. What is the best approach?
5A network operations center (NOC) is deploying streaming telemetry from Cisco IOS-XE devices to a Kafka-based analytics platform. The engineer needs to ensure that the telemetry data is encoded in a compact, efficient format for high-volume streaming. Which encoding format should the engineer configure?
6A network engineer is troubleshooting a performance issue on a Cisco Catalyst 9300 switch. The engineer suspects that a specific application is using excessive bandwidth. The switch supports Flexible NetFlow. The engineer wants to monitor only the traffic from that application without affecting the switch's CPU. What is the most efficient way to configure this?
7A company is deploying Cisco DNA Center and wants to use streaming telemetry from its network devices to provide real-time visibility. The network consists of Cisco Catalyst 9000 switches running IOS-XE. The engineer needs to configure the devices to stream telemetry data to DNA Center. Which protocol should the engineer use for the telemetry transport?
8A network engineer is configuring NetFlow on a Cisco Nexus 7000 switch to monitor traffic between two data centers. The engineer wants to ensure that flow records are exported even if the export destination is temporarily unreachable. Which feature should the engineer enable?
9A network engineer is deploying streaming telemetry from a Cisco ASR 1000 router to a collector using gRPC. The engineer notices that the telemetry data is not being received by the collector. The router shows that the gRPC server is running and the collector is reachable. What is the most likely cause?
10A network engineer runs the following command on Router R1: R1# show ip ospf neighbor Neighbor ID Pri State Dead Time Address Interface 10.0.0.2 1 FULL/DR 00:00:34 192.168.1.2 GigabitEthernet0/0 10.0.0.3 1 2WAY/DROTHER 00:00:38 192.168.1.3 GigabitEthernet0/0 Based on this output, what can be concluded?
11A network engineer runs the following command on Router R1: R1# show bgp summary BGP router identifier 192.168.1.1, local AS number 65001 BGP table version is 10, main routing table version 10 Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd 192.168.1.2 4 65002 1024 1020 10 0 0 00:12:34 15 192.168.1.3 4 65003 2048 2040 10 0 0 00:24:56 20 Based on this output, what can be concluded?
12A network engineer runs the following command on Router R1: R1# show ip route 192.168.2.0 Routing entry for 192.168.2.0/24 Known via "ospf 1", distance 110, metric 20, type inter area Last update from 10.0.0.2 on GigabitEthernet0/0, 00:05:23 ago Routing Descriptor Blocks: * 10.0.0.2, via GigabitEthernet0/0, 00:05:23 ago Route metric is 20, traffic share count is 1 Based on this output, what can be concluded?
13A network engineer runs the following command on Switch SW1: SW1# show vlan brief VLAN Name Status Ports ---- -------------------------------- --------- ------------------------------- 1 default active Gi0/1, Gi0/2, Gi0/3 10 Sales active Gi0/4, Gi0/5 20 Engineering active Gi0/6, Gi0/7 1002 fddi-default act/unsup 1003 token-ring-default act/unsup 1004 fddinet-default act/unsup 1005 trnet-default act/unsup Based on this output, what can be concluded?
14A network engineer runs the following command on Switch SW1: SW1# show spanning-tree vlan 10 VLAN0010 Spanning tree enabled protocol ieee Root ID Priority 32778 Address 0011.2233.4455 Cost 19 Port 1 (GigabitEthernet0/1) Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Bridge ID Priority 32778 (priority 32768 sys-id-ext 10) Address 0011.2233.4466 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 sec Interface Role Sts Cost Prio.Nbr Type ------------------- ---- --- --------- -------- -------------------------------- Gi0/1 Root FWD 19 128.1 P2p Gi0/2 Altn BLK 19 128.2 P2p Based on this output, what can be concluded?
15A network engineer runs the following command on Switch SW1: SW1# show etherchannel summary Flags: D - down P - bundled in port-channel I - stand-alone s - suspended H - Hot-standby (LACP only) R - Layer3 S - Layer2 U - in use N - not in use, no aggregation f - failed to allocate aggregator M - not in use, minimum links not met u - unsuitable for bundling w - waiting to be aggregated d - default port Number of channel-groups in use: 1 Number of aggregators: 1 Group Port-channel Protocol Ports ------+-------------+-----------+-------------------------------------------- 1 Po1(SU) LACP Gi0/1(P) Gi0/2(P) Gi0/3(D) Based on this output, what can be concluded?
16A network engineer runs the following command on Router R1: R1# show ip nat translations Pro Inside global Inside local Outside local Outside global --- 192.168.1.10:1024 10.0.0.10:1024 203.0.113.5:80 203.0.113.5:80 tcp 192.168.1.10:1025 10.0.0.10:1025 203.0.113.5:80 203.0.113.5:80 --- 192.168.1.11:2048 10.0.0.11:2048 198.51.100.2:443 198.51.100.2:443 Based on this output, what can be concluded?
17A network engineer runs the following command on Router R1: R1# show mpls ldp neighbor Peer LDP Ident: 10.0.0.2:0, Local LDP Ident: 10.0.0.1:0 TCP connection: 10.0.0.2.646 - 10.0.0.1.179 State: Oper; Msgs sent/rcvd: 100/95; Downstream Up time: 00:10:00 LDP discovery sources: GigabitEthernet0/0, Src IP: 10.0.0.2 Addresses bound to peer LDP Ident: 10.0.0.2 192.168.2.2 Peer LDP Ident: 10.0.0.3:0, Local LDP Ident: 10.0.0.1:0 TCP connection: 10.0.0.3.646 - 10.0.0.1.179 State: Oper; Msgs sent/rcvd: 200/190; Downstream Up time: 00:20:00 LDP discovery sources: GigabitEthernet0/1, Src IP: 10.0.0.3 Addresses bound to peer LDP Ident: 10.0.0.3 192.168.3.3 Based on this output, what can be concluded?
18A network engineer runs the following command on Router R1: R1# show ip pim neighbor PIM Neighbor Table Neighbor Address Interface Uptime Expires Mode 10.0.0.2 GigabitEthernet0/0 00:10:00 00:01:30 Dense 10.0.0.3 GigabitEthernet0/1 00:20:00 00:01:20 Sparse Based on this output, what can be concluded?
19Examine the following configuration snippet: interface GigabitEthernet0/1 ip flow monitor FLOW-MONITOR input ip flow monitor FLOW-MONITOR output ! flow monitor FLOW-MONITOR exporter EXPORTER-1 record netflow ipv4 original-input ! flow exporter EXPORTER-1 destination 192.168.1.100 transport udp 2055 ! What is the effect of this configuration?
20Consider the following configuration: flow exporter EXPORTER-1 destination 10.0.0.1 source Loopback0 transport udp 9996 template data timeout 60 ! Which statement about this configuration is true?
21Given the configuration: flow monitor FM-1 exporter EXPORTER-1 record netflow ipv4 original-input cache timeout active 60 cache timeout inactive 15 ! What is the effect of the 'cache timeout active 60' command?
22Examine the following configuration: flow record REC-1 match ipv4 source address match ipv4 destination address match ipv4 protocol collect interface input collect interface output collect counter bytes collect counter packets ! flow monitor MON-1 record REC-1 exporter EXPORTER-1 ! interface GigabitEthernet0/1 ip flow monitor MON-1 input ! What is the purpose of this configuration?
23Consider the following configuration: flow monitor FM-1 exporter EXPORTER-1 record netflow ipv4 original-input cache entries 16000 ! Which statement about this configuration is correct?
24Examine the following configuration: flow exporter EXPORTER-1 destination 10.0.0.1 source Loopback0 transport udp 2055 option interface-table option application-table ! What is the purpose of the 'option interface-table' and 'option application-table' commands?
25What is the default OSPF hello interval on a broadcast multi-access network (e.g., Ethernet)?
26Which BGP attribute is preferred when it has the lowest value?
27What is the maximum hop count for EIGRP?
28Drag and drop the steps of NetFlow v9 cache export process into the correct order, from first to last.
29Drag and drop the steps of configuring model-driven telemetry with gRPC on a Cisco IOS-XE device into the correct order, from first to last.
30Drag and drop the steps of troubleshooting NetFlow export issues into the correct order, from first to last.
31Drag and drop the steps of Flexible NetFlow flow record and exporter setup into the correct order, from first to last.
32Drag and drop the steps of IPFIX template negotiation and export into the correct order, from first to last.
33Drag and drop the steps of sFlow agent sampling and forwarding steps into the correct order, from first to last.
34Drag and drop the steps of YANG data model traversal for interface stats into the correct order, from first to last.
35Drag and drop the steps of Streaming telemetry sensor path subscription flow into the correct order, from first to last.
36Drag and drop the steps of Flexible NetFlow flow record and exporter setup into the correct order, from first to last.
37Drag and drop the steps of IPFIX template negotiation and export into the correct order, from first to last.
38Drag and drop the steps of sFlow agent sampling and forwarding steps into the correct order, from first to last.
39Drag and drop the steps of YANG data model traversal for interface stats into the correct order, from first to last.
40Drag and drop the steps of streaming telemetry sensor path subscription flow into the correct order, from first to last.
41Drag and drop each NetFlow version on the left to its matching feature description on the right.
42Drag and drop each flow record field on the left to its matching category (key or non-key) on the right.
43Drag and drop each telemetry model on the left to its matching push type (dial-in or dial-out) on the right.
44Drag and drop each YANG module on the left to its matching standard body on the right.
45Drag and drop each sFlow component on the left to its matching function on the right.
46Drag and drop each NetFlow version on the left to its matching feature on the right.
47Drag and drop each flow record field on the left to its matching category (key or non-key) on the right.
48Drag and drop each telemetry model on the left to its matching push type (dial-in or dial-out) on the right.
49Drag and drop each YANG module on the left to its matching standard body on the right.
50Drag and drop each sFlow component on the left to its matching function on the right.
51Which two statements about NetFlow are true? (Choose two.)
52Which three statements about model-driven telemetry are true? (Choose three.)
53Which two statements about NetFlow flow records and export are correct? (Choose two.)
54Which three statements about telemetry protocols and data collection are true? (Choose three.)
55Which two statements about NetFlow are true? (Choose two.)
56Which three statements about model-driven telemetry are true? (Choose three.)
57Which two statements about Flexible NetFlow are true? (Choose two.)
58Which three statements about telemetry data collection methods are true? (Choose three.)
The NetFlow and Telemetry domain covers the key concepts tested in this area of the 350-401 exam blueprint published by Cisco. Courseiva provides free domain-focused practice, mock exams, missed-question review, and readiness tracking across all 350-401 domains — no account required.
The Courseiva 350-401 question bank contains 58 questions in the NetFlow and Telemetry domain. Click any question to see the full explanation and answer breakdown.
Start with a 10-question focused session to identify your baseline accuracy in this domain. Read every explanation — even for questions you answer correctly — to understand the reasoning. Once you score consistently above 80%, move to a 20–30 question session to confirm depth before moving to the next domain.
Yes — the session launcher on this page draws questions exclusively from the NetFlow and Telemetry domain. Choose 10, 20, 30, or 50 questions for a focused session, or click individual questions to review them one by one.
Save your results, see per-domain analytics, and get readiness scores — free, for every certification.
Sign Up FreeFree forever · Every certification included