350-401 NetFlow and Telemetry Practice Questions

Question 1

A network engineer is troubleshooting intermittent packet loss on a WAN link connecting two data centers. The engineer suspects that certain traffic types are being dropped but needs to confirm this without impacting production. The engineer has access to Cisco IOS-XE routers at both ends. Which approach should the engineer use to identify the specific flows being dropped?

Accepted Answer

Configure Flexible NetFlow on the routers with a flow monitor that includes the 'drop' keyword to capture dropped packets per flow.. NetFlow can be used to monitor traffic flows and identify drops, but traditional NetFlow does not capture drops. The correct answer uses Flexible NetFlow with a flow monitor that includes the 'drop' keyword to capture dropped packets, which is the most direct method. Option B is incorrect because SNMP polling of interface counters shows aggregate drops but not per-flow. Option C is incorrect because EEM alone cannot capture per-flow drop details. Option D is incorrect because IP SLA measures performance but not drop causation per flow.

Answer

Enable SNMP polling of interface counters to identify the total number of dropped packets on the WAN interface.

Answer

Use Embedded Event Manager (EEM) to trigger on interface drops and capture a packet trace.

Answer

Deploy IP SLA probes to measure latency and jitter, and correlate with drop events.

Question 2

A large enterprise is migrating from traditional SNMP-based monitoring to streaming telemetry for better scalability and real-time visibility. The network team has Cisco Nexus 9000 switches running NX-OS. They want to stream interface counters and BGP neighbor state changes to a collector. Which telemetry technology should they implement?

Accepted Answer

Configure model-driven telemetry (MDT) using gRPC or gNMI to subscribe to the desired YANG data models for interface counters and BGP state.. Model-driven telemetry (MDT) using gRPC or gNMI is the modern approach for streaming structured data from NX-OS devices. Option A is correct because MDT supports both periodic and event-driven subscriptions. Option B is incorrect because NetFlow is for flow data, not interface counters or BGP state. Option C is incorrect because SNMP traps are event-driven but not scalable for high-frequency streaming. Option D is incorrect because IP SLA is for active measurements, not streaming device state.

Answer

Enable NetFlow v9 on the switches and configure the collector to receive flow records that include interface statistics.

Answer

Use SNMP traps to send interface and BGP state changes to the collector.

Answer

Deploy IP SLA responders on the switches to measure performance and send results via syslog.

Question 3

A network engineer is configuring NetFlow on a Cisco ISR 4451 router to analyze traffic patterns. The engineer wants to export flow data to a collector every 60 seconds. After applying the configuration, the engineer notices that the export packets are not reaching the collector. The collector is reachable via ICMP. What is the most likely cause?

Accepted Answer

The 'ip flow-export destination' command is missing or specifies an incorrect UDP port number.. NetFlow export uses UDP as the transport protocol, and the collector must be listening on the correct UDP port. Option A is correct because the export destination must specify the correct UDP port. Option B is incorrect because NetFlow does not require TCP. Option C is incorrect because the flow monitor is needed for Flexible NetFlow, but traditional NetFlow uses 'ip flow-export'. Option D is incorrect because the timeout setting affects when flows are exported, not the reachability of export packets.

Answer

The router is using TCP for NetFlow export, but the collector only supports UDP.

Answer

The flow monitor is not applied to any interface, so no flows are being collected.

Answer

The 'ip flow-export timeout rate' is set too high, causing export packets to be delayed.

Question 4

A service provider is using Cisco ASR 9000 routers and needs to collect NetFlow data from multiple customers' traffic. The engineer wants to ensure that flow records from different customers are not mixed and can be identified separately. The router supports Flexible NetFlow. What is the best approach?

Accepted Answer

Define a custom flow record that includes the 'match ipv4 vlan' or 'match ipv4 vrf' field to identify each customer's traffic, and apply a single flow monitor on the shared interface.. Flexible NetFlow allows customization of flow records. Option A is correct by using a flow record with a 'match ipv4 vlan' or 'match ipv4 vrf' field to tag flows per customer. Option B is incorrect because separate flow monitors for each interface would still mix flows if multiple customers share an interface. Option C is incorrect because NetFlow v9 export format does not inherently separate customers. Option D is incorrect because SNMP is not suitable for per-customer flow identification.

Answer

Configure a separate flow monitor for each customer interface and export to different collectors.

Answer

Use NetFlow v9 export with the 'match ipv4 source address' field only, and rely on the collector to separate by source IP.

Answer

Enable SNMP interface polling to track per-customer traffic statistics.

Question 5

A network operations center (NOC) is deploying streaming telemetry from Cisco IOS-XE devices to a Kafka-based analytics platform. The engineer needs to ensure that the telemetry data is encoded in a compact, efficient format for high-volume streaming. Which encoding format should the engineer configure?

Accepted Answer

Google Protocol Buffers (GPB) encoding.. For high-volume streaming telemetry, efficient encoding is critical. Option A is correct because GPB (Google Protocol Buffers) is a compact binary format that reduces bandwidth and parsing overhead. Option B is incorrect because JSON is text-based and verbose. Option C is incorrect because XML is even more verbose. Option D is incorrect because CSV is not a standard telemetry encoding and lacks structure.

Answer

JSON encoding.

Answer

XML encoding.

Answer

CSV encoding.

Question 6

A network engineer is troubleshooting a performance issue on a Cisco Catalyst 9300 switch. The engineer suspects that a specific application is using excessive bandwidth. The switch supports Flexible NetFlow. The engineer wants to monitor only the traffic from that application without affecting the switch's CPU. What is the most efficient way to configure this?

Accepted Answer

Define a flow record that matches the specific application using NBAR or an ACL, and apply a flow monitor with a sampler rate to reduce CPU impact.. Flexible NetFlow allows filtering to reduce CPU impact. Option A is correct because using a flow record with a match on the application (e.g., NBAR or ACL) and a sampler reduces the number of flows processed. Option B is incorrect because capturing all flows would increase CPU load. Option C is incorrect because SNMP polling gives aggregate data, not per-application. Option D is incorrect because mirroring all traffic to a probe would also increase CPU load.

Answer

Enable NetFlow on all interfaces and export all flows to the collector, then filter at the collector.

Answer

Use SNMP to poll interface counters and calculate the bandwidth used by the application.

Answer

Configure port mirroring (SPAN) to send all traffic to an external probe for analysis.

Question 7

A company is deploying Cisco DNA Center and wants to use streaming telemetry from its network devices to provide real-time visibility. The network consists of Cisco Catalyst 9000 switches running IOS-XE. The engineer needs to configure the devices to stream telemetry data to DNA Center. Which protocol should the engineer use for the telemetry transport?

Accepted Answer

gRPC (Google Remote Procedure Call).. Cisco DNA Center uses model-driven telemetry with gRPC as the preferred transport for streaming data from IOS-XE devices. Option A is correct because gRPC is the standard for MDT. Option B is incorrect because NetFlow is for flow data, not device state. Option C is incorrect because SNMP is not used for streaming telemetry in DNA Center. Option D is incorrect because syslog is for log messages, not structured telemetry.

Answer

NetFlow v9.

Answer

SNMPv3.

Answer

Syslog.

Question 8

A network engineer is configuring NetFlow on a Cisco Nexus 7000 switch to monitor traffic between two data centers. The engineer wants to ensure that flow records are exported even if the export destination is temporarily unreachable. Which feature should the engineer enable?

Accepted Answer

Increase the NetFlow export buffer size and configure the export retry interval.. NetFlow export uses UDP, which is unreliable. Option A is correct because NetFlow export buffer and retry mechanisms (like 'ip flow-export buffer-size' and 'ip flow-export retry') can store and retransmit records. Option B is incorrect because TCP is not supported for NetFlow export. Option C is incorrect because SNMP traps are not for flow data. Option D is incorrect because IP SLA does not buffer NetFlow records.

Answer

Change the export protocol to TCP to ensure reliable delivery.

Answer

Enable SNMP traps to notify the collector of flow data.

Answer

Configure IP SLA to monitor the collector and buffer flows locally.

Question 9

A network engineer is deploying streaming telemetry from a Cisco ASR 1000 router to a collector using gRPC. The engineer notices that the telemetry data is not being received by the collector. The router shows that the gRPC server is running and the collector is reachable. What is the most likely cause?

Accepted Answer

No telemetry subscription is configured on the router for the desired data paths.. For gRPC telemetry, the router must have a subscription configured to send data. Option A is correct because without a subscription, no data is streamed. Option B is incorrect because the server is running. Option C is incorrect because the collector is reachable. Option D is incorrect because the encoding format does not prevent data from being sent if the server is up.

Answer

The gRPC server is configured with the wrong port number.

Answer

The collector is not listening on the same IP address as configured on the router.

Answer

The telemetry data is encoded in GPB, but the collector expects JSON.

Question 10

A network engineer runs the following command on Router R1:

R1# show ip ospf neighbor

Neighbor ID     Pri   State           Dead Time   Address         Interface
10.0.0.2          1   FULL/DR         00:00:34    192.168.1.2     GigabitEthernet0/0
10.0.0.3          1   2WAY/DROTHER    00:00:38    192.168.1.3     GigabitEthernet0/0

Based on this output, what can be concluded?

Accepted Answer

The local router is the Backup Designated Router (BDR). The output shows OSPF neighbors on a multi-access network. The neighbor with state FULL/DR is the Designated Router, and the neighbor with state 2WAY/DROTHER is a non-DR/BDR router that has formed a two-way adjacency but is not adjacent to the DR. The local router must be either the BDR or a DROTHER, as it is not listed as DR. The correct answer is that the local router is the Backup Designated Router (BDR).

Answer

The local router is the Designated Router (DR)

Answer

The local router is a DROTHER

Answer

The OSPF network type is point-to-point

NetFlow and Telemetry