CCNA AI and Network Operations Practice Question
A network engineer is tasked with monitoring a large enterprise network that requires high-frequency, real-time data collection from thousands of routers and switches. The engineer needs a solution that minimizes CPU overhead on the network devices and supports push-based data delivery. Which technology should the engineer choose for this requirement?
⚠ Common exam trap
Cisco often tests the distinction between pull-based (SNMP) and push-based (telemetry) models, and the trap here is that candidates may confuse NetFlow or IPFIX as 'push-based' monitoring tools for device health metrics, when they are actually designed for traffic flow analysis and lack the structured, high-frequency, model-driven data collection that streaming telemetry provides.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Streaming telemetry
Streaming telemetry uses a push model (e.g., gRPC or UDP-based dial-out) to continuously send structured data (YANG-modeled, often encoded in GPB or JSON) from network devices to a collector, which eliminates the need for periodic polling. This minimizes CPU overhead because the device only encodes and transmits data when a subscription triggers an update, rather than processing repeated SNMP GET requests. It is designed for high-frequency, real-time data collection at scale, making it ideal for monitoring thousands of routers and switches with minimal performance impact.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SNMPv2c with frequent polling intervals
Why it's wrong here
SNMPv2c relies on a pull model where the network management station (NMS) queries each device over UDP/161, and frequent polling intervals amplify CPU and network overhead on the managed device. This model does not scale to thousands of devices because the NMS must sequentially or concurrently poll each one, and even with high-frequency polling, real-time state changes can be missed between queries. Unlike streaming telemetry, SNMPv2c lacks an effective push-based subscription mechanism, making it inefficient for dense, real-time operational monitoring.
- ✓
Streaming telemetry
Why this is correct
Streaming telemetry uses a push-based model in which devices continuously stream operational data (e.g., CPU, memory, interface counters) to collectors via protocols like gRPC with GPB or JSON encoded data over a long-lived session. This dramatically reduces overhead on the device because the collector subscribes to specific data paths and the device sends updates at configured cadence or on event-driven triggers, eliminating the need for repeated request-response polling. This approach scales to thousands of devices and provides near-real-time visibility, making it the optimal choice for large-scale network monitoring.
- ✗
NetFlow
Why it's wrong here
NetFlow is designed for traffic flow analysis, capturing metadata such as source/destination IP addresses, ports, and protocol for each flow, rather than device health metrics like CPU utilization or memory consumption. It exports flow records via UDP typically to a collector, but this export is asynchronous and not intended for high-frequency, low-latency monitoring of operational states. Moreover, NetFlow's flow cache and export logic are oriented toward visibility into network traffic patterns, not device performance telemetry, so it cannot substitute for streaming telemetry in a real-time device monitoring solution.
- ✗
IPFIX
Why it's wrong here
IPFIX is an extension of NetFlow for flexible flow export. Like NetFlow, it is focused on traffic flows, not device health metrics, and does not provide the push-based efficiency of streaming telemetry for real-time monitoring.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Streaming telemetryCorrect answer▾
Why this is correct
Streaming telemetry uses a push-based model in which devices continuously stream operational data (e.g., CPU, memory, interface counters) to collectors via protocols like gRPC with GPB or JSON encoded data over a long-lived session. This dramatically reduces overhead on the device because the collector subscribes to specific data paths and the device sends updates at configured cadence or on event-driven triggers, eliminating the need for repeated request-response polling. This approach scales to thousands of devices and provides near-real-time visibility, making it the optimal choice for large-scale network monitoring.
✗SNMPv2c with frequent polling intervalsWrong answer — click to see why▾
Why this is wrong here
SNMPv2c uses a pull model where the manager polls devices for data. Frequent polling intervals increase CPU usage on network devices and can cause scalability issues with thousands of devices, making it unsuitable for high-frequency, real-time data collection with minimal overhead.
Why candidates choose this
Students may think SNMP is the standard for network monitoring and that increasing polling frequency can achieve real-time data, but they overlook the CPU overhead and scalability limitations of the pull model.
✗NetFlowWrong answer — click to see why▾
Why this is wrong here
NetFlow is designed for traffic flow analysis, capturing details like source/destination IPs and ports, not for collecting device health metrics such as CPU or memory. Its export mechanism can be CPU-intensive and does not provide the push-based efficiency needed for real-time monitoring of device status.
Why candidates choose this
Students may confuse NetFlow with a general monitoring tool because it exports data, but they fail to recognize its specific focus on traffic flows rather than device metrics.
✗IPFIXWrong answer — click to see why▾
Why this is wrong here
IPFIX is an extension of NetFlow for flexible flow export and shares the same focus on traffic flows, not device health metrics. Like NetFlow, it does not offer the push-based, low-overhead data delivery required for real-time monitoring of thousands of devices.
Why candidates choose this
Students might think IPFIX is more advanced and could be used for device monitoring, but it is still flow-based and not designed for telemetry data collection.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Agentic AI in Network Operations
Key term
User Datagram Protocol
User Datagram Protocol (UDP) is a fast, connectionless network protocol that sends data without first checking if the receiver is ready or if the data arrived safely.
Key term
UDP
UDP (User Datagram Protocol) is a communication protocol that sends data quickly without first checking if the receiver is ready or if the data arrived correctly.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.