CCNA Network Services and Security Practice Question
A network team wants visibility into which flows are consuming the most bandwidth between internal subnets. Which technology is most directly associated with that goal?
⚠ Common exam trap
A frequent exam trap is mistaking Syslog or DHCP relay as solutions for traffic flow visibility. Syslog only records system events and error messages, not detailed traffic usage. DHCP relay simply forwards DHCP requests and does not analyze bandwidth. Another trap is confusing PortFast, which is an STP feature to speed up port activation, with traffic monitoring technologies. Candidates must recognize that only NetFlow provides granular flow data needed to identify bandwidth consumption between internal subnets, making it the correct choice.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
NetFlow
NetFlow provides visibility into traffic flows, allowing administrators to identify which flows (e.g., between internal subnets) are consuming the most bandwidth by showing source/destination, protocols, and traffic volume. Syslog only records system logs and events, not flow-level data. DHCP relay forwards DHCP broadcasts across subnets but offers no traffic analysis. PortFast is an STP optimization that speeds up port transition to forwarding; it does not monitor bandwidth usage.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
NetFlow
Why this is correct
NetFlow is a network telemetry protocol that captures metadata about IP traffic flows, including source/destination IP addresses, ports, ToS, and byte/packet counts. By exporting these flow records to a collector, administrators can identify which applications, hosts, or conversations are consuming the most bandwidth. This makes NetFlow the appropriate technology for flow-level visibility and traffic consumption analysis.
- ✗
Syslog
Why it's wrong here
Syslog is a client/server messaging protocol used to transport log messages from network devices, servers, and applications to a central logging server. These messages report syslog severity levels, events, and configuration changes but contain only individual log entries, not network flow statistics or bandwidth consumption data. Therefore, syslog cannot identify which flows are consuming resources, as it lacks flow-key data like IP pairs and byte counts.
When this WOULD be correct
If the question asked about monitoring and logging network events or troubleshooting network issues, then Syslog would be the correct answer, as it captures logs from devices to help diagnose problems.
- ✗
DHCP relay
Why it's wrong here
DHCP relay, typically implemented as the "ip helper-address" feature, forwards broadcast DHCP DISCOVER and REQUEST packets from clients on one subnet to a DHCP server on another subnet. This operation solves the problem of IP address assignment across L3 boundaries, but it does not monitor, sample, or record network traffic flows. It simply unicasts or broadcasts DHCP messages, so it has no mechanism for reporting which flows are consuming bandwidth.
When this WOULD be correct
If the exam question asked about technologies that facilitate the management of IP address allocation and client-server communication in a network, then DHCP relay would be the correct answer. For example, a question might ask which technology helps in extending DHCP services across multiple subnets.
- ✗
PortFast
Why it's wrong here
PortFast is a Cisco STP enhancement that configures an access port as an edge port, allowing it to transition immediately from blocking to forwarding without listening and learning states. It is used only to speed up convergence for end hosts and prevent STP delays, and it has no packet sampling, flow caching, or accounting capability. Thus, PortFast is irrelevant to traffic-flow consumption visibility.
When this WOULD be correct
If the question asked about optimizing switch port performance in a network with rapid device connections, PortFast would be the correct answer. For example, a scenario focusing on reducing connection delays for devices in a dynamic environment could make this option valid.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓NetFlowCorrect answer▾
Why this is correct
NetFlow is a network telemetry protocol that captures metadata about IP traffic flows, including source/destination IP addresses, ports, ToS, and byte/packet counts. By exporting these flow records to a collector, administrators can identify which applications, hosts, or conversations are consuming the most bandwidth. This makes NetFlow the appropriate technology for flow-level visibility and traffic consumption analysis.
✗SyslogWrong answer — click to see why▾
Why this is wrong here
Syslog is primarily used for logging and monitoring system events, not for analyzing network flow data or bandwidth consumption between subnets. It does not provide the granularity needed for flow analysis.
★ When this WOULD be the correct answer
If the question asked about monitoring and logging network events or troubleshooting network issues, then Syslog would be the correct answer, as it captures logs from devices to help diagnose problems.
Why candidates choose this
Candidates may confuse Syslog with network monitoring tools, thinking that any logging mechanism can provide insights into bandwidth usage, leading them to select it despite its specific function.
✗DHCP relayWrong answer — click to see why▾
Why this is wrong here
DHCP relay is used to forward DHCP requests and responses between clients and servers across different networks. It does not provide visibility into bandwidth consumption or flow analysis between subnets.
★ When this WOULD be the correct answer
If the exam question asked about technologies that facilitate the management of IP address allocation and client-server communication in a network, then DHCP relay would be the correct answer. For example, a question might ask which technology helps in extending DHCP services across multiple subnets.
Why candidates choose this
Candidates may confuse DHCP relay with network monitoring tools, thinking it relates to traffic management due to its role in facilitating communication across subnets, leading them to select it mistakenly.
✗PortFastWrong answer — click to see why▾
Why this is wrong here
PortFast is a feature that allows a switch port to transition directly to the forwarding state, bypassing the listening and learning states of Spanning Tree Protocol. It does not provide visibility into bandwidth consumption or flow analysis between subnets.
★ When this WOULD be the correct answer
If the question asked about optimizing switch port performance in a network with rapid device connections, PortFast would be the correct answer. For example, a scenario focusing on reducing connection delays for devices in a dynamic environment could make this option valid.
Why candidates choose this
Candidates might confuse PortFast with network performance optimization features, mistakenly believing it relates to monitoring or managing bandwidth usage, especially if they are familiar with its role in enhancing connectivity speed.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Diagnosing DNS Record Issues — A, AAAA, CNAME, MX, NS, and PTR Records
Key term
STP
STP (Spanning Tree Protocol) is a network protocol that prevents loops in Ethernet networks by creating a loop-free logical topology.
Key term
NetFlow
NetFlow is a network protocol developed by Cisco that collects and monitors IP traffic data to provide visibility into network usage, performance, and security.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.