Netflow practice questions

You are connected to R1, a Cisco IOS-XE router. Configure SNMP v2c with read-only community 'NetOpsRO' and SNMP v3 with user 'AdminUser' using SHA authentication (password: AuthPass1) and AES-128 encryption (password: PrivPass2). Also enable SNMP traps to the NMS at 192.0.2.10 with community 'TrapComm'. Additionally, configure NetFlow export to 192.0.2.20 using version 9, and ensure the flow exporter is applied to GigabitEthernet0/0. Verify your configuration using 'show snmp' and 'show ip cache flow'.

Exhibit

R1#show running-config | section snmp|flow
Building configuration...
!
ip flow-export source GigabitEthernet0/0
ip flow-export version 9
!
snmp-server community NetOpsRO RO
snmp-server enable traps snmp
snmp-server host 192.0.2.10 version 2c TrapComm
!
end

R1#show ip cache flow
IP packet size distribution (0 total packets):
    (No flow data yet)

R1#

Trap 1: snmp-server community NetOpsRO ro snmp-server user AdminUser v3…

This is incorrect because the SNMPv3 user is created without a group, which is required for authentication and privacy privileges. Also, 'ip flow export' is not a valid interface command; the correct command is 'ip flow monitor' referencing a flow monitor that uses the exporter.

Trap 2: snmp-server community NetOpsRO ro snmp-server group AdminGroup v3…

This is incorrect because the 'snmp-server host' command includes 'version 2c', which forces traps to be sent using SNMPv2c with the community string. However, the trap community 'TrapComm' is specified, but the command syntax is correct; the error is that the trap destination should not specify version 2c if the community is intended for v2c traps, but the question does not specify version, so it's acceptable. Actually, the main error is missing the flow exporter reference in the flow monitor; the flow monitor must be configured with the exporter. The given config does not show the flow monitor configuration.

Trap 3: snmp-server community NetOpsRO ro snmp-server group AdminGroup v3…

This is incorrect because the flow monitor configuration is placed after the interface command, which is out of order. The flow monitor must be configured before it is applied to the interface. Additionally, the 'flow monitor' command should be in global configuration mode, not after the interface command.

A
snmp-server community NetOpsRO ro snmp-server group AdminGroup v3 priv snmp-server user AdminUser AdminGroup v3 auth sha AuthPass1 priv aes 128 PrivPass2 snmp-server enable traps snmp-server host 192.0.2.10 TrapComm flow exporter EXPORTER destination 192.0.2.20 version 9 ! flow monitor FLOW-MONITOR exporter EXPORTER record netflow ipv4 original-input ! interface GigabitEthernet0/0 ip flow monitor FLOW-MONITOR input
This configuration correctly sets up SNMP v2c and v3, enables traps, creates the flow exporter, defines the required global flow monitor, and applies it to the interface.
B
snmp-server community NetOpsRO ro snmp-server user AdminUser v3 auth sha AuthPass1 priv aes 128 PrivPass2 snmp-server enable traps snmp-server host 192.0.2.10 TrapComm flow exporter EXPORTER destination 192.0.2.20 version 9 ! interface GigabitEthernet0/0 ip flow export EXPORTER
Why wrong: This is incorrect because the SNMPv3 user is created without a group, which is required for authentication and privacy privileges. Also, 'ip flow export' is not a valid interface command; the correct command is 'ip flow monitor' referencing a flow monitor that uses the exporter.
C
snmp-server community NetOpsRO ro snmp-server group AdminGroup v3 priv snmp-server user AdminUser AdminGroup v3 auth sha AuthPass1 priv aes 128 PrivPass2 snmp-server enable traps snmp-server host 192.0.2.10 version 2c TrapComm flow exporter EXPORTER destination 192.0.2.20 version 9 ! interface GigabitEthernet0/0 ip flow monitor FLOW-MONITOR input
Why wrong: This is incorrect because the 'snmp-server host' command includes 'version 2c', which forces traps to be sent using SNMPv2c with the community string. However, the trap community 'TrapComm' is specified, but the command syntax is correct; the error is that the trap destination should not specify version 2c if the community is intended for v2c traps, but the question does not specify version, so it's acceptable. Actually, the main error is missing the flow exporter reference in the flow monitor; the flow monitor must be configured with the exporter. The given config does not show the flow monitor configuration.
D
snmp-server community NetOpsRO ro snmp-server group AdminGroup v3 priv snmp-server user AdminUser AdminGroup v3 auth sha AuthPass1 priv aes 128 PrivPass2 snmp-server enable traps snmp-server host 192.0.2.10 TrapComm flow exporter EXPORTER destination 192.0.2.20 version 9 ! interface GigabitEthernet0/0 ip flow monitor FLOW-MONITOR input flow monitor FLOW-MONITOR exporter EXPORTER
Why wrong: This is incorrect because the flow monitor configuration is placed after the interface command, which is out of order. The flow monitor must be configured before it is applied to the interface. Additionally, the 'flow monitor' command should be in global configuration mode, not after the interface command.

Question 2hardScenario

You are connected to R1, a Cisco ISR 4331 router running IOS-XE. Your task is to enable SNMP v2c with community string 'public' (read-only) and 'private' (read-write), and configure SNMP v3 with a user 'admin' using SHA authentication (password 'Cisco123') and AES 128 encryption (password 'Cisco456'). Additionally, configure SNMP traps to be sent to a management server at 203.0.113.10 for both v2c and v3. Finally, enable NetFlow export to a collector at 203.0.113.20, using version 9. Verify your configuration using 'show snmp' and 'show ip cache flow'.

Exhibit

Current running-config of R1 (relevant sections):
!
hostname R1
!
interface GigabitEthernet0/0
 ip address 192.0.2.1 255.255.255.252
 no shut
!
interface GigabitEthernet0/1
 ip address 198.51.100.1 255.255.255.0
 no shut
!
ip route 0.0.0.0 0.0.0.0 192.0.2.2
!
end

Trap 1: snmp-server community public snmp-server community…

This configuration is incorrect because it uses MD5 instead of SHA for SNMPv3 authentication and DES instead of AES 128 for encryption. Additionally, the community strings lack the RO and RW keywords, which are required to specify access levels.

Trap 2: snmp-server community public RO snmp-server community private…

This configuration incorrectly uses the private community string for the v2c trap host. The v2c trap host should use the read-only community string 'public' as specified in the question, not the read-write 'private'.

Trap 3: snmp-server community public RO snmp-server community private…

This configuration incorrectly uses NetFlow version 5 instead of version 9. The question explicitly requires version 9, which supports templates and is more flexible than the older version 5.

A
snmp-server community public RO snmp-server community private RW snmp-server user admin v3group v3 auth sha Cisco123 priv aes 128 Cisco456 snmp-server enable traps snmp-server host 203.0.113.10 version 2c public snmp-server host 203.0.113.10 version 3 auth admin ip flow-export destination 203.0.113.20 2055 ip flow-export version 9
Correctly configures SNMP v2c communities with proper permissions, SNMP v3 user with the required group name (v3group), SHA authentication, and AES-128 encryption, enables traps for both versions with the correct target hosts, and sets NetFlow export to version 9.
B
snmp-server community public snmp-server community private snmp-server user admin v3 auth md5 Cisco123 priv des56 Cisco456 snmp-server enable traps snmp-server host 203.0.113.10 version 2c public snmp-server host 203.0.113.10 version 3 auth admin ip flow-export destination 203.0.113.20 2055 ip flow-export version 9
Why wrong: This configuration is incorrect because it uses MD5 instead of SHA for SNMPv3 authentication and DES instead of AES 128 for encryption. Additionally, the community strings lack the RO and RW keywords, which are required to specify access levels.
C
snmp-server community public RO snmp-server community private RW snmp-server user admin v3 auth sha Cisco123 priv aes 128 Cisco456 snmp-server enable traps snmp-server host 203.0.113.10 version 2c private snmp-server host 203.0.113.10 version 3 auth admin ip flow-export destination 203.0.113.20 2055 ip flow-export version 9
Why wrong: This configuration incorrectly uses the private community string for the v2c trap host. The v2c trap host should use the read-only community string 'public' as specified in the question, not the read-write 'private'.
D
snmp-server community public RO snmp-server community private RW snmp-server user admin v3 auth sha Cisco123 priv aes 128 Cisco456 snmp-server enable traps snmp-server host 203.0.113.10 version 2c public snmp-server host 203.0.113.10 version 3 auth admin ip flow-export destination 203.0.113.20 2055 ip flow-export version 5
Why wrong: This configuration incorrectly uses NetFlow version 5 instead of version 9. The question explicitly requires version 9, which supports templates and is more flexible than the older version 5.

Question 3hardScenario

You are connected to R1 via the console. SNMP v2c community strings (public RO, private RW) are already configured. The network has a management server at 10.1.1.100 and a NetFlow collector at 10.1.1.200. Configure SNMP traps to the management server for link status changes. Also configure NetFlow on interface GigabitEthernet0/0 to export version 9 to the collector, with a source interface of Loopback0 (10.255.255.1/32).

Exhibit

R1#show running-config | section snmp|flow
Building configuration...

Current configuration : 1234 bytes
!
snmp-server community public RO
snmp-server community private RW
!
! No trap or NetFlow configuration exists
!
interface GigabitEthernet0/0
 ip address 10.0.0.1 255.255.255.252
 duplex auto
 speed auto
 media-type rj45
!
interface Loopback0
 ip address 10.255.255.1 255.255.255.255
!
end

Trap 1: snmp-server host 10.1.1.200 version 2c private snmp-server enable…

This configuration is incorrect because the trap destination is set to the NetFlow collector (10.1.1.200) instead of the management server (10.1.1.100), and the NetFlow export destination is set to the management server instead of the collector. Additionally, NetFlow should be configured as ingress, not egress.

Trap 2: snmp-server host 10.1.1.100 version 2c private snmp-server enable…

This configuration uses the read-write community string 'private' for SNMP traps instead of the read-only 'public'. While the trap destination and NetFlow settings are correct, the community string must match the read-only community for traps.

Trap 3: snmp-server host 10.1.1.100 version 2c public snmp-server enable…

This configuration uses NetFlow version 5 instead of version 9. The question explicitly requires version 9. All other settings are correct.

A
snmp-server host 10.1.1.100 version 2c public snmp-server enable traps snmp linkdown linkup ip flow-export destination 10.1.1.200 2055 ip flow-export version 9 ip flow-export source Loopback0 interface GigabitEthernet0/0 ip flow ingress
This option correctly configures SNMPv2c with the read-only community to the management server, enables the required link status traps, and sets up NetFlow v9 export to the collector with proper source and monitoring on the interface.
B
snmp-server host 10.1.1.200 version 2c private snmp-server enable traps ip flow-export destination 10.1.1.100 2055 version 9 ip flow-export source Loopback0 interface GigabitEthernet0/0 ip flow egress
Why wrong: This configuration is incorrect because the trap destination is set to the NetFlow collector (10.1.1.200) instead of the management server (10.1.1.100), and the NetFlow export destination is set to the management server instead of the collector. Additionally, NetFlow should be configured as ingress, not egress.
C
snmp-server host 10.1.1.100 version 2c private snmp-server enable traps ip flow-export destination 10.1.1.200 2055 version 9 ip flow-export source Loopback0 interface GigabitEthernet0/0 ip flow ingress
Why wrong: This configuration uses the read-write community string 'private' for SNMP traps instead of the read-only 'public'. While the trap destination and NetFlow settings are correct, the community string must match the read-only community for traps.
D
snmp-server host 10.1.1.100 version 2c public snmp-server enable traps snmp linkdown linkup ip flow-export destination 10.1.1.200 2055 version 5 ip flow-export source Loopback0 interface GigabitEthernet0/0 ip flow ingress
Why wrong: This configuration uses NetFlow version 5 instead of version 9. The question explicitly requires version 9. All other settings are correct.

Question 4hardmultiple choice

An administrator sees high interface utilization through SNMP graphs but wants to identify which conversations are responsible. Which addition best closes that visibility gap?

Trap 1: Another DHCP scope

This is wrong because DHCP scopes do not explain bandwidth conversations.

Trap 2: A new STP priority

This is wrong because STP priority is unrelated to traffic-conversation visibility.

Trap 3: A larger OSPF metric

This is wrong because OSPF metrics do not identify which flows are consuming bandwidth.

A
NetFlow
This is correct because NetFlow adds detailed visibility into traffic conversations behind utilization.
B
Another DHCP scope
Why wrong: This is wrong because DHCP scopes do not explain bandwidth conversations.
C
A new STP priority
Why wrong: This is wrong because STP priority is unrelated to traffic-conversation visibility.
D
A larger OSPF metric
Why wrong: This is wrong because OSPF metrics do not identify which flows are consuming bandwidth.

Question 5mediumdrag order

Drag and drop the following phases into the correct order to configure gRPC streaming telemetry subscription setup and then the NetFlow data path sequence.

Trap 1: 1

This is incorrect because the telemetry subscription should be configured before NetFlow export, and the flow monitor must be defined before it can be applied to an interface.

Trap 2: 1

This is incorrect because telemetry should be configured before NetFlow export, and the flow monitor must be defined before it is applied to an interface.

Trap 3: 1

This is incorrect because the flow monitor cannot be applied before it is defined, and telemetry should be configured before NetFlow export.

A
1. Configure gRPC telemetry subscription 2. Configure NetFlow export destination 3. Define flow monitor 4. Apply flow monitor to interface
This order correctly follows the sequence: first set up the telemetry subscription to stream data, then configure NetFlow export to send flow records, define the flow monitor to specify what to collect, and finally apply it to the interface where traffic is monitored.
B
1. Define flow monitor 2. Apply flow monitor to interface 3. Configure gRPC telemetry subscription 4. Configure NetFlow export destination
Why wrong: This is incorrect because the telemetry subscription should be configured before NetFlow export, and the flow monitor must be defined before it can be applied to an interface.
C
1. Configure NetFlow export destination 2. Define flow monitor 3. Apply flow monitor to interface 4. Configure gRPC telemetry subscription
Why wrong: This is incorrect because telemetry should be configured before NetFlow export, and the flow monitor must be defined before it is applied to an interface.
D
1. Apply flow monitor to interface 2. Configure gRPC telemetry subscription 3. Define flow monitor 4. Configure NetFlow export destination
Why wrong: This is incorrect because the flow monitor cannot be applied before it is defined, and telemetry should be configured before NetFlow export.