CCNA Network Services and Security Practice Question
Exhibit
Router(config)# ip flow-export destination 192.0.2.50 2055 Router(config)# ip flow-export version 9
Exhibit: A company wants to export traffic statistics from routers to a collector for visibility into top talkers and application usage. Which two statements are accurate?
⚠ Common exam trap
Be cautious not to confuse general network monitoring tools like Syslog and SNMP with specialized traffic analysis tools like NetFlow.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
NetFlow can export flow data to a collector
NetFlow exports flow records to a collector and is useful for traffic analysis and accounting visibility, enabling identification of top talkers and application usage (options A and B are correct). Syslog reports events and messages, but does not replace flow records for conversation-level traffic statistics, so option C is incorrect. NetFlow does not replace routing protocols for path selection; it is a traffic monitoring tool, not a routing mechanism, so option D is incorrect. NetFlow works on routers and Layer 3 switches, not only Layer 2 switches, so option E is incorrect.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
NetFlow can export flow data to a collector
Why this is correct
NetFlow operates on the device by maintaining an in-memory cache of active flows; when a flow expires or the cache fills, the exporter packages the records into UDP datagrams, usually on port 2055 or 9996, and sends them to an external collector. The collector (e.g., SolarWinds, PRTG, Elastic) stores and correlates these records for historical reporting, capacity planning, and traffic accounting. Thus export is the essential delivery mechanism that makes the captured flow metadata usable for centralized analysis.
- ✓
NetFlow helps identify traffic patterns and top talkers
Why this is correct
NetFlow samples or inspects forwarded packets and aggregates them into unidirectional flows keyed by seven-tuple fields such as source/destination IP, ports, protocol, and ToS. By accumulating flow records, it reveals conversational pairs, application mix, and bandwidth consumption, letting engineers rank endpoints by volume and spot anomalous or dominant traffic sources. It is a passive telemetry mechanism, not a control-plane function.
- ✗
Syslog and NetFlow are the same feature with different names
Why it's wrong here
Syslog is a text-based event log protocol that carries messages about device events, interface state changes, and system errors to a logging server, while NetFlow is a binary flow export protocol carrying aggregated traffic metadata and byte/packet counters. They have different transport behavior, data formats, and purposes: syslog supports a broad range of operational events in ASCII, whereas NetFlow supports a narrow high-volume traffic measurement function. They are complementary telemetry tools and not interchangeable by any name.
When this WOULD be correct
If the question asked 'Which two statements are true about Syslog and NetFlow?' and included an option stating 'Both Syslog and NetFlow can be used for network monitoring and troubleshooting,' that would be correct because both provide visibility into network events, albeit different types of data.
- ✗
NetFlow replaces routing protocols for path selection
Why it's wrong here
Routing protocols such as OSPF, EIGRP, or BGP build the IP routing table by exchanging reachability and metric information, and that table determines the next hop for each packet. NetFlow is strictly observational; it neither installs routes, modifies forwarding decisions, nor participates in the control plane. Removing or disabling routing protocols causes connectivity failure regardless of NetFlow, because flow telemetry only describes traffic that has already been forwarded using routing decisions.
When this WOULD be correct
In a question asking which technology can be used to influence routing decisions based on traffic flows, such as in traffic engineering with MPLS-TE or policy-based routing, NetFlow itself is not used, but if the question were about a protocol that replaces routing protocols for path selection, the answer would be something like MPLS-TE or segment routing, not NetFlow.
- ✗
NetFlow only works on Layer 2 switches and never on routers
Why it's wrong here
NetFlow is primarily supported on routers and Layer 3 switches because it captures IP flows during packets' route lookup and forwarding, though many platforms support it on switched interfaces too. Cisco routers from ISR to ASR series and IOS-XE, IOS, and NX-OS all support NetFlow or Flexible NetFlow. The statement is factually false on platform support and also conflates NetFlow's L3/IP flow nature with L2 switching.
When this WOULD be correct
In a question that asks 'Which device type is limited to Layer 2 switching and cannot run NetFlow?', the correct answer would be a pure Layer 2 switch that does not support NetFlow, but modern switches often do.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓NetFlow can export flow data to a collectorCorrect answer▾
Why this is correct
NetFlow operates on the device by maintaining an in-memory cache of active flows; when a flow expires or the cache fills, the exporter packages the records into UDP datagrams, usually on port 2055 or 9996, and sends them to an external collector. The collector (e.g., SolarWinds, PRTG, Elastic) stores and correlates these records for historical reporting, capacity planning, and traffic accounting. Thus export is the essential delivery mechanism that makes the captured flow metadata usable for centralized analysis.
✗Syslog and NetFlow are the same feature with different namesWrong answer — click to see why▾
Why this is wrong here
Syslog is a protocol for logging system messages, while NetFlow is a traffic flow monitoring technology that exports metadata about network flows. They serve entirely different purposes and are not the same feature.
★ When this WOULD be the correct answer
If the question asked 'Which two statements are true about Syslog and NetFlow?' and included an option stating 'Both Syslog and NetFlow can be used for network monitoring and troubleshooting,' that would be correct because both provide visibility into network events, albeit different types of data.
Why candidates choose this
Candidates may confuse Syslog and NetFlow because both are used for network monitoring and generate logs or records, leading to the mistaken belief they are interchangeable or the same feature.
✗NetFlow replaces routing protocols for path selectionWrong answer — click to see why▾
Why this is wrong here
NetFlow is a traffic monitoring and analysis tool, not a routing protocol. It does not influence path selection; routing protocols like OSPF or BGP handle that.
★ When this WOULD be the correct answer
In a question asking which technology can be used to influence routing decisions based on traffic flows, such as in traffic engineering with MPLS-TE or policy-based routing, NetFlow itself is not used, but if the question were about a protocol that replaces routing protocols for path selection, the answer would be something like MPLS-TE or segment routing, not NetFlow.
Why candidates choose this
Candidates may confuse NetFlow's ability to analyze traffic flows with the idea that it can control or replace routing decisions, especially if they think 'flow' implies path selection.
✗NetFlow only works on Layer 2 switches and never on routersWrong answer — click to see why▾
Why this is wrong here
NetFlow operates on routers and switches at Layer 3 and above, not exclusively on Layer 2 switches. It is commonly deployed on routers for traffic monitoring.
★ When this WOULD be the correct answer
In a question that asks 'Which device type is limited to Layer 2 switching and cannot run NetFlow?', the correct answer would be a pure Layer 2 switch that does not support NetFlow, but modern switches often do.
Why candidates choose this
Candidates may confuse NetFlow with features like port mirroring that are more common on switches, or mistakenly think NetFlow is only for Layer 2 due to its flow-based nature.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Routing Protocol Comparison
| Protocol | Metric | Max Hops | Algorithm | Type |
|---|---|---|---|---|
| RIP v2 | Hop count | 15 | Bellman-Ford | Distance vector |
| OSPF | Cost (bandwidth) | Unlimited | Dijkstra (SPF) | Link state |
| EIGRP | Composite metric | Unlimited | DUAL | Hybrid |
| IS-IS | Cost | Unlimited | Dijkstra | Link state |
| BGP | Policy / attributes | Unlimited | Path vector | Path vector |
RIP's 15-hop limit makes it unsuitable for large networks. OSPF and EIGRP dominate modern enterprise deployments.
Go deeper
Related to this question
Learn chapter
Diagnosing DNS Record Issues — A, AAAA, CNAME, MX, NS, and PTR Records
Key term
Syslog
Syslog is a standard protocol used to send and store log messages from network devices and servers to a central logging server for monitoring and troubleshooting.
Key term
NetFlow
NetFlow is a network protocol developed by Cisco that collects and monitors IP traffic data to provide visibility into network usage, performance, and security.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.