CCNP Practice Question: Given the configuration: flow monitor FM-1…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Flows that are active for more than 60 seconds are exported immediately and then removed from the cache.

  Why this is correct

  This statement is correct, but the nuance is that when the active timeout (configured with 'ip flow-cache timeout active 60') expires, the flow is exported immediately to the collector, yet if the flow is still in progress, NetFlow creates a new cache entry to track the continuation of the same session. This prevents long-lived flows (e.g., large file transfers) from being invisible until they end, providing periodic accounting updates. The original cache entry is indeed removed after export, but the flow's data is not lost; it is continued in the new entry with a fresh start time.

• ✗

  Flows that are inactive for 60 seconds are exported and removed from the cache.

  Why it's wrong here

  This is incorrect because the inactive timeout (or idle timeout) is a separate, usually much shorter timer, such as 15 seconds, not 60. The inactive timeout triggers when no packets have been seen for that interval, and the flow is exported and removed from the cache to reclaim resources. The 60-second value mentioned in the option is typically the active timeout, which applies to flows that are continuously generating traffic, not idle ones. Thus, this option conflates the two distinct aging mechanisms and assigns the wrong behavior to the wrong timer.

• ✗

  The cache will hold a maximum of 60 active flows at any time.

  Why it's wrong here

  This misinterprets the command 'ip flow-cache timeout active 60'. That command sets a time duration, not a count of flows. The maximum number of active flows in the cache is controlled by the cache size, configured with 'ip flow-cache entries', which defaults to thousands of entries. The active timeout merely determines the longest period a continuously active flow can occupy a cache entry before it is aged out and exported; it has no effect on how many flows can be stored simultaneously. Therefore, the cache will not 'hold a maximum of 60 active flows', but rather will expire flows older than 60 seconds.

• ✗

  Flow records are sent to the exporter every 60 seconds.

  Why it's wrong here

  This is wrong because the exporter's transmission rate is governed by the NetFlow export mechanism, not by the cache active timeout. Flow records are sent to the collector when they age out (due to active/inactive timeout, or when the flow ends with FIN/RST) and are batched according to the export format and the exporter's protocol settings (UDP/TCP/SCTP). The active timeout of 60 seconds means individual flows are exported after 60 seconds of activity, but the exporter does not send a report every 60 seconds as a periodic heartbeat. Instead, it sends records as they become available, which could be at various times depending on flow durations and the order in which they age.