350-401 NetFlow and Telemetry — 15 Questions

Question 1

A network engineer is troubleshooting intermittent packet loss on a WAN link connecting two data centers. The engineer suspects that certain traffic types are being dropped but needs to confirm this without impacting production. The engineer has access to Cisco IOS-XE routers at both ends. Which approach should the engineer use to identify the specific flows being dropped?

Accepted Answer

Configure Flexible NetFlow on the routers with a flow monitor that includes the 'drop' keyword to capture dropped packets per flow.. NetFlow can be used to monitor traffic flows and identify drops, but traditional NetFlow does not capture drops. The correct answer uses Flexible NetFlow with a flow monitor that includes the 'drop' keyword to capture dropped packets, which is the most direct method. Option B is incorrect because SNMP polling of interface counters shows aggregate drops but not per-flow. Option C is incorrect because EEM alone cannot capture per-flow drop details. Option D is incorrect because IP SLA measures performance but not drop causation per flow.

Answer

Enable SNMP polling of interface counters to identify the total number of dropped packets on the WAN interface.

Answer

Use Embedded Event Manager (EEM) to trigger on interface drops and capture a packet trace.

Answer

Deploy IP SLA probes to measure latency and jitter, and correlate with drop events.

Question 2

A large enterprise is migrating from traditional SNMP-based monitoring to streaming telemetry for better scalability and real-time visibility. The network team has Cisco Nexus 9000 switches running NX-OS. They want to stream interface counters and BGP neighbor state changes to a collector. Which telemetry technology should they implement?

Accepted Answer

Configure model-driven telemetry (MDT) using gRPC or gNMI to subscribe to the desired YANG data models for interface counters and BGP state.. Model-driven telemetry (MDT) using gRPC or gNMI is the modern approach for streaming structured data from NX-OS devices. Option A is correct because MDT supports both periodic and event-driven subscriptions. Option B is incorrect because NetFlow is for flow data, not interface counters or BGP state. Option C is incorrect because SNMP traps are event-driven but not scalable for high-frequency streaming. Option D is incorrect because IP SLA is for active measurements, not streaming device state.

Answer

Enable NetFlow v9 on the switches and configure the collector to receive flow records that include interface statistics.

Answer

Use SNMP traps to send interface and BGP state changes to the collector.

Answer

Deploy IP SLA responders on the switches to measure performance and send results via syslog.

Question 3

A network engineer is configuring NetFlow on a Cisco ISR 4451 router to analyze traffic patterns. The engineer wants to export flow data to a collector every 60 seconds. After applying the configuration, the engineer notices that the export packets are not reaching the collector. The collector is reachable via ICMP. What is the most likely cause?

Accepted Answer

The 'ip flow-export destination' command is missing or specifies an incorrect UDP port number.. NetFlow export uses UDP as the transport protocol, and the collector must be listening on the correct UDP port. Option A is correct because the export destination must specify the correct UDP port. Option B is incorrect because NetFlow does not require TCP. Option C is incorrect because the flow monitor is needed for Flexible NetFlow, but traditional NetFlow uses 'ip flow-export'. Option D is incorrect because the timeout setting affects when flows are exported, not the reachability of export packets.

Answer

The router is using TCP for NetFlow export, but the collector only supports UDP.

Answer

The flow monitor is not applied to any interface, so no flows are being collected.

Answer

The 'ip flow-export timeout rate' is set too high, causing export packets to be delayed.

Question 4

A service provider is using Cisco ASR 9000 routers and needs to collect NetFlow data from multiple customers' traffic. The engineer wants to ensure that flow records from different customers are not mixed and can be identified separately. The router supports Flexible NetFlow. What is the best approach?

Accepted Answer

Define a custom flow record that includes the 'match ipv4 vlan' or 'match ipv4 vrf' field to identify each customer's traffic, and apply a single flow monitor on the shared interface.. Flexible NetFlow allows customization of flow records. Option A is correct by using a flow record with a 'match ipv4 vlan' or 'match ipv4 vrf' field to tag flows per customer. Option B is incorrect because separate flow monitors for each interface would still mix flows if multiple customers share an interface. Option C is incorrect because NetFlow v9 export format does not inherently separate customers. Option D is incorrect because SNMP is not suitable for per-customer flow identification.

Answer

Configure a separate flow monitor for each customer interface and export to different collectors.

Answer

Use NetFlow v9 export with the 'match ipv4 source address' field only, and rely on the collector to separate by source IP.

Answer

Enable SNMP interface polling to track per-customer traffic statistics.

Question 5

A network operations center (NOC) is deploying streaming telemetry from Cisco IOS-XE devices to a Kafka-based analytics platform. The engineer needs to ensure that the telemetry data is encoded in a compact, efficient format for high-volume streaming. Which encoding format should the engineer configure?

Accepted Answer

Google Protocol Buffers (GPB) encoding.. For high-volume streaming telemetry, efficient encoding is critical. Option A is correct because GPB (Google Protocol Buffers) is a compact binary format that reduces bandwidth and parsing overhead. Option B is incorrect because JSON is text-based and verbose. Option C is incorrect because XML is even more verbose. Option D is incorrect because CSV is not a standard telemetry encoding and lacks structure.

Answer

JSON encoding.

Answer

XML encoding.

Answer

CSV encoding.

Question 6

A network engineer is troubleshooting a performance issue on a Cisco Catalyst 9300 switch. The engineer suspects that a specific application is using excessive bandwidth. The switch supports Flexible NetFlow. The engineer wants to monitor only the traffic from that application without affecting the switch's CPU. What is the most efficient way to configure this?

Accepted Answer

Define a flow record that matches the specific application using NBAR or an ACL, and apply a flow monitor with a sampler rate to reduce CPU impact.. Flexible NetFlow allows filtering to reduce CPU impact. Option A is correct because using a flow record with a match on the application (e.g., NBAR or ACL) and a sampler reduces the number of flows processed. Option B is incorrect because capturing all flows would increase CPU load. Option C is incorrect because SNMP polling gives aggregate data, not per-application. Option D is incorrect because mirroring all traffic to a probe would also increase CPU load.

Answer

Enable NetFlow on all interfaces and export all flows to the collector, then filter at the collector.

Answer

Use SNMP to poll interface counters and calculate the bandwidth used by the application.

Answer

Configure port mirroring (SPAN) to send all traffic to an external probe for analysis.

Question 7

A company is deploying Cisco DNA Center and wants to use streaming telemetry from its network devices to provide real-time visibility. The network consists of Cisco Catalyst 9000 switches running IOS-XE. The engineer needs to configure the devices to stream telemetry data to DNA Center. Which protocol should the engineer use for the telemetry transport?

Accepted Answer

gRPC (Google Remote Procedure Call).. Cisco DNA Center uses model-driven telemetry with gRPC as the preferred transport for streaming data from IOS-XE devices. Option A is correct because gRPC is the standard for MDT. Option B is incorrect because NetFlow is for flow data, not device state. Option C is incorrect because SNMP is not used for streaming telemetry in DNA Center. Option D is incorrect because syslog is for log messages, not structured telemetry.

Answer

NetFlow v9.

Answer

SNMPv3.

Answer

Syslog.

Question 8

A network engineer is configuring NetFlow on a Cisco Nexus 7000 switch to monitor traffic between two data centers. The engineer wants to ensure that flow records are exported even if the export destination is temporarily unreachable. Which feature should the engineer enable?

Accepted Answer

Increase the NetFlow export buffer size and configure the export retry interval.. NetFlow export uses UDP, which is unreliable. Option A is correct because NetFlow export buffer and retry mechanisms (like 'ip flow-export buffer-size' and 'ip flow-export retry') can store and retransmit records. Option B is incorrect because TCP is not supported for NetFlow export. Option C is incorrect because SNMP traps are not for flow data. Option D is incorrect because IP SLA does not buffer NetFlow records.

Answer

Change the export protocol to TCP to ensure reliable delivery.

Answer

Enable SNMP traps to notify the collector of flow data.

Answer

Configure IP SLA to monitor the collector and buffer flows locally.

Question 9

A network engineer is deploying streaming telemetry from a Cisco ASR 1000 router to a collector using gRPC. The engineer notices that the telemetry data is not being received by the collector. The router shows that the gRPC server is running and the collector is reachable. What is the most likely cause?

Accepted Answer

No telemetry subscription is configured on the router for the desired data paths.. For gRPC telemetry, the router must have a subscription configured to send data. Option A is correct because without a subscription, no data is streamed. Option B is incorrect because the server is running. Option C is incorrect because the collector is reachable. Option D is incorrect because the encoding format does not prevent data from being sent if the server is up.

Answer

The gRPC server is configured with the wrong port number.

Answer

The collector is not listening on the same IP address as configured on the router.

Answer

The telemetry data is encoded in GPB, but the collector expects JSON.

Question 10

A network engineer runs the following command on Router R1:

R1# show ip ospf neighbor

Neighbor ID     Pri   State           Dead Time   Address         Interface
10.0.0.2          1   FULL/DR         00:00:34    192.168.1.2     GigabitEthernet0/0
10.0.0.3          1   2WAY/DROTHER    00:00:38    192.168.1.3     GigabitEthernet0/0

Based on this output, what can be concluded?

Accepted Answer

The local router is the Backup Designated Router (BDR). The output shows OSPF neighbors on a multi-access network. The neighbor with state FULL/DR is the Designated Router, and the neighbor with state 2WAY/DROTHER is a non-DR/BDR router that has formed a two-way adjacency but is not adjacent to the DR. The local router must be either the BDR or a DROTHER, as it is not listed as DR. The correct answer is that the local router is the Backup Designated Router (BDR).

Answer

The local router is the Designated Router (DR)

Answer

The local router is a DROTHER

Answer

The OSPF network type is point-to-point

Question 11

A network engineer runs the following command on Router R1:

R1# show bgp summary

BGP router identifier 192.168.1.1, local AS number 65001
BGP table version is 10, main routing table version 10
Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
192.168.1.2     4        65002    1024    1020       10    0    0 00:12:34       15
192.168.1.3     4        65003    2048    2040       10    0    0 00:24:56       20

Based on this output, what can be concluded?

Accepted Answer

Both BGP sessions are in the established state. The output shows BGP neighbors and their state. Both neighbors are in established state (PfxRcd shows number of prefixes received). The local AS is 65001, and the neighbors are in different AS numbers (65002 and 65003), indicating eBGP sessions. The correct answer is that both BGP sessions are established and exchanging prefixes.

Answer

The BGP session with 192.168.1.2 is idle

Answer

Router R1 is using iBGP with both neighbors

Answer

The BGP table version is 10, meaning 10 prefixes are in the table

Question 12

A network engineer runs the following command on Router R1:

R1# show ip route 192.168.2.0

Routing entry for 192.168.2.0/24
  Known via "ospf 1", distance 110, metric 20, type inter area
  Last update from 10.0.0.2 on GigabitEthernet0/0, 00:05:23 ago
  Routing Descriptor Blocks:
  * 10.0.0.2, via GigabitEthernet0/0, 00:05:23 ago
      Route metric is 20, traffic share count is 1

Based on this output, what can be concluded?

Accepted Answer

The route is an OSPF inter-area route. The output shows a specific route in the routing table. The route is learned via OSPF, with a metric of 20, and is an inter-area route (type inter area). The next hop is 10.0.0.2 via GigabitEthernet0/0. The correct answer is that the route is an OSPF inter-area route.

Answer

The route is an OSPF intra-area route

Answer

The route is an OSPF external route

Answer

The route is learned via EIGRP

Question 13

A network engineer runs the following command on Switch SW1:

SW1# show vlan brief

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Gi0/1, Gi0/2, Gi0/3
10   Sales                            active    Gi0/4, Gi0/5
20   Engineering                      active    Gi0/6, Gi0/7
1002 fddi-default                     act/unsup
1003 token-ring-default               act/unsup
1004 fddinet-default                  act/unsup
1005 trnet-default                    act/unsup

Based on this output, what can be concluded?

Accepted Answer

VLANs 10 and 20 are configured and have ports assigned. The output shows VLANs configured on the switch. VLANs 1, 10, and 20 are active and have ports assigned. VLANs 1002-1005 are default VLANs that are not supported on this platform (act/unsup). The correct answer is that VLANs 10 and 20 are configured and have ports assigned.

Answer

All VLANs are in the active state and supported

Answer

VLAN 1 is the only VLAN with ports assigned

Answer

The switch is running VTP transparent mode

Question 14

A network engineer runs the following command on Switch SW1:

SW1# show spanning-tree vlan 10

VLAN0010
  Spanning tree enabled protocol ieee
  Root ID    Priority    32778
             Address     0011.2233.4455
             Cost        19
             Port        1 (GigabitEthernet0/1)
             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec

Bridge ID  Priority    32778  (priority 32768 sys-id-ext 10)
             Address     0011.2233.4466
             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  300 sec

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Gi0/1               Root FWD 19        128.1    P2p
Gi0/2               Altn BLK 19        128.2    P2p

Based on this output, what can be concluded?

Accepted Answer

The local switch is not the root bridge for VLAN 10. The output shows spanning-tree information for VLAN 10. The root bridge has priority 32778 and address 0011.2233.4455. The local switch has a different bridge ID (0011.2233.4466), so it is not the root. Interface Gi0/1 is the root port (Root, FWD), and Gi0/2 is an alternate port (Altn, BLK). The correct answer is that the local switch is not the root bridge for VLAN 10.

Answer

The local switch is the root bridge for VLAN 10

Answer

Interface Gi0/2 is in a forwarding state

Answer

The spanning-tree mode is Rapid PVST+

Question 15

A network engineer runs the following command on Switch SW1:

SW1# show etherchannel summary

Flags:  D - down        P - bundled in port-channel
        I - stand-alone s - suspended
        H - Hot-standby (LACP only)
        R - Layer3      S - Layer2
        U - in use      N - not in use, no aggregation
        f - failed to allocate aggregator

M - not in use, minimum links not met
        u - unsuitable for bundling
        w - waiting to be aggregated
        d - default port

Number of channel-groups in use: 1
Number of aggregators:           1

Group  Port-channel  Protocol    Ports
------+-------------+-----------+--------------------------------------------
1      Po1(SU)         LACP      Gi0/1(P)   Gi0/2(P)   Gi0/3(D)

Based on this output, what can be concluded?

Accepted Answer

The EtherChannel is operational with two active links. The output shows an EtherChannel summary. Port-channel 1 is in use (U) and Layer2 (S). The protocol is LACP. Two ports (Gi0/1 and Gi0/2) are bundled (P), but Gi0/3 is down (D). The correct answer is that the EtherChannel is operational with two active links.

Answer

The EtherChannel is fully operational with three active links

Answer

The EtherChannel is using PAgP protocol

Answer

The EtherChannel is a Layer 3 port-channel