CCNA Network Services and Security Practice Question
A team wants to know which internal hosts are sending the most traffic to a specific data center subnet. Which technology is most directly associated with that visibility goal?
⚠ Common exam trap
A common exam trap is selecting Syslog or DHCP when asked about traffic visibility. Syslog focuses on logging system events and device messages, not on analyzing who is sending traffic or how much. DHCP is solely for IP address assignment and does not provide any traffic flow data. Candidates might confuse these because they are familiar Cisco technologies, but neither provides the flow-level traffic insight that NetFlow offers. Misunderstanding the purpose of these protocols leads to incorrect answers, especially under time pressure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
NetFlow
NetFlow is the best fit because it provides visibility into traffic flows and conversations. In practical terms, it helps answer questions like who is talking to whom, over which protocols and ports, and how much traffic is being exchanged. That makes it useful for capacity, troubleshooting, and unusual-traffic analysis. This is different from Syslog, which reports device events, and from general SNMP polling, which focuses more on device and interface counters.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
NetFlow
Why this is correct
NetFlow exports flow records containing source and destination IP addresses, port numbers and byte counts, so an administrator can rank internal hosts by volume sent to a specific data centre subnet. That per-conversation traffic accounting directly satisfies the visibility requirement, which SNMP interface counters cannot attribute to individual hosts.
- ✗
Syslog
Why it's wrong here
Syslog transports event and error messages to a collector; it carries no byte or packet counts per host, so it cannot rank senders by traffic volume to a subnet. It is tempting because syslog gives network-wide visibility, but that visibility covers logged events, not flow statistics, which NetFlow supplies.
When this WOULD be correct
If the question were about monitoring system logs for security events or troubleshooting network devices, Syslog would be the correct answer. For example, a question asking which technology is best for collecting and analyzing logs from network devices to detect anomalies would make Syslog the appropriate choice.
- ✗
DHCP
Why it's wrong here
DHCP assigns IP addresses and options to hosts; it records no per-host traffic volumes or destinations, so it cannot rank senders by bytes to a subnet. It is tempting because DHCP servers hold a list of internal hosts, but that inventory suits address management, not flow accounting, which NetFlow provides.
When this WOULD be correct
If the exam question asked about identifying which hosts are obtaining IP addresses from a DHCP server or tracking IP address leases, then DHCP would be the correct answer. This would focus on IP address management rather than traffic analysis.
- ✗
PortFast
Why it's wrong here
PortFast changes spanning-tree behaviour on access ports, moving them immediately to forwarding; it collects no traffic statistics, so it cannot identify which hosts send the most data. It is tempting because it is configured on switch access ports where hosts connect, but flow accounting, not STP edge tuning, answers the question.
When this WOULD be correct
If the question were about optimizing switch port configurations for rapid connectivity in a network where traffic patterns are less critical, PortFast would be the correct answer. For example, a question asking about reducing the time it takes for a port to become active after being connected could correctly point to PortFast.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓NetFlowCorrect answer▾
Why this is correct
NetFlow exports flow records containing source and destination IP addresses, port numbers and byte counts, so an administrator can rank internal hosts by volume sent to a specific data centre subnet. That per-conversation traffic accounting directly satisfies the visibility requirement, which SNMP interface counters cannot attribute to individual hosts.
✗SyslogWrong answer — click to see why▾
Why this is wrong here
Syslog is primarily used for logging and monitoring system events and messages, not for analyzing traffic patterns or volumes. It does not provide the necessary visibility into network traffic flows to identify which hosts are sending the most traffic to a specific subnet.
★ When this WOULD be the correct answer
If the question were about monitoring system logs for security events or troubleshooting network devices, Syslog would be the correct answer. For example, a question asking which technology is best for collecting and analyzing logs from network devices to detect anomalies would make Syslog the appropriate choice.
Why candidates choose this
Candidates might choose Syslog because they associate it with network monitoring and management, thinking it could provide insights into traffic patterns through log data, despite its primary function being event logging.
✗DHCPWrong answer — click to see why▾
Why this is wrong here
DHCP is primarily used for dynamically assigning IP addresses to devices on a network, not for monitoring traffic flow. It does not provide visibility into which hosts are sending traffic to a specific subnet.
★ When this WOULD be the correct answer
If the exam question asked about identifying which hosts are obtaining IP addresses from a DHCP server or tracking IP address leases, then DHCP would be the correct answer. This would focus on IP address management rather than traffic analysis.
Why candidates choose this
Candidates may confuse DHCP's role in network management with traffic monitoring, mistakenly believing that it can provide insights into traffic patterns based on IP address assignments.
✗PortFastWrong answer — click to see why▾
Why this is wrong here
PortFast is a feature that allows a switch port to transition directly to the forwarding state, bypassing the listening and learning states. It does not provide visibility into traffic patterns or data flow, which is the focus of the question.
★ When this WOULD be the correct answer
If the question were about optimizing switch port configurations for rapid connectivity in a network where traffic patterns are less critical, PortFast would be the correct answer. For example, a question asking about reducing the time it takes for a port to become active after being connected could correctly point to PortFast.
Why candidates choose this
Candidates might confuse the need for traffic management with port configuration features, thinking that optimizing port states could somehow relate to traffic visibility, leading them to select PortFast.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Troubleshoot: No IP Connectivity Between Hosts
Key term
NetFlow
NetFlow is a network protocol developed by Cisco that collects and monitors IP traffic data to provide visibility into network usage, performance, and security.
Key term
Subnet
A subnet is a logical subdivision of an IP network, created by partitioning a larger network address space using subnet masks.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,450 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.