CCNA Network Services and Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  It summarizes traffic into flows instead of capturing every packet payload

  Why this is correct

  NetFlow operates by grouping packets that share common attributes—like IP addresses, port numbers, protocol, and ToS—into unidirectional flows, then exporting a summary record containing counters and timestamps. This avoids the storage and processing overhead of capturing every packet's full payload, making it efficient for long-term traffic analysis. Unlike deep packet inspection, NetFlow does not reconstruct or retain the application data itself, only the flow metadata.

• ✗

  It is primarily used to distribute time from an authoritative clock

  Why it's wrong here

  This description matches NTP (Network Time Protocol), which synchronizes clocks across network devices by distributing time from authoritative sources like GPS or stratum servers. NetFlow, by contrast, is a flow-based monitoring tool that captures metadata about IP traffic—such as source and destination addresses, ports, and byte counts—rather than time synchronization. Its purpose is to provide visibility into network traffic patterns, not to maintain clock accuracy.

  When this WOULD be correct

  In a question asking 'Which protocol is used to synchronize clocks across network devices?' or 'Which technology distributes time from an authoritative clock?', NTP would be the correct answer.

• ✓

  It can help identify which conversations consume the most bandwidth

  Why this is correct

  Because each flow record tracks bytes and packets between a specific source and destination, administrators can aggregate that data to rank conversations by traffic volume. This reveals 'top talkers,' identifies unusually heavy bandwidth consumers, and helps pinpoint what applications or hosts drive link utilization. Such visibility is a key motivator for deploying NetFlow, as it supports capacity planning and anomaly detection without needing to inspect every packet's content.

• ✗

  It replaces routing protocols by advertising reachability information

  Why it's wrong here

  NetFlow is not a routing protocol and has no role in advertising reachability or building the routing table. Routing protocols like OSPF, EIGRP, or BGP exchange route information to determine the best paths, whereas NetFlow passively observes traffic after forwarding decisions have already been made. Confusing NetFlow with a routing protocol misrepresents its function as a post-forwarding accounting and analysis tool.

  When this WOULD be correct

  In a question asking about the purpose of a routing protocol (e.g., BGP or OSPF), an option stating that it 'advertises reachability information' would be correct. For example: 'Which protocol is used to exchange routing information between autonomous systems?'

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question