mediumMultiple Select
CCNP Practice Question: Which two statements about NetFlow are true?…
Which two statements about NetFlow are true? (Choose two.)
⚠ Common exam trap
350-401 often tests the misconception that NetFlow replaces SNMP for interface utilization, but NetFlow is flow-level and sampled, while SNMP provides exact interface counters.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
NetFlow records are unidirectional by default.
Option A is correct because a standard NetFlow flow record is defined by a unidirectional 5-tuple (source IP, destination IP, source port, destination port, and protocol), so each direction of a conversation is tracked as a separate flow entry. Option B is correct because Sampled NetFlow applies a sampling rate (for example, 1 out of every 100 packets) so the router or switch only inspects a subset of traffic, which lowers CPU and memory overhead compared with full NetFlow accounting. Option C is not correct because user-defined flow keys and flexible field selection require Flexible NetFlow export formats such as NetFlow v9 or IPFIX, not the fixed NetFlow v5 record layout. Option D is not correct because NetFlow provides flow-level traffic detail and is complementary to SNMP interface counters, not a drop-in replacement for SNMP polling of interface utilization. Option E is not correct because NetFlow v9 is template-based and can carry IPv4, IPv6, MPLS, and other protocol fields, not only IPv4 traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
NetFlow records are unidirectional by default.
Why this is correct
A NetFlow flow is defined by a one-way tuple of source and destination addresses, ports, and protocol, so each record describes traffic in a single direction. Return traffic generates a separate record, which is why bidirectional analysis requires correlating two flows.
- ✓
Sampled NetFlow reduces CPU impact by analyzing only a subset of packets.
Why this is correct
Sampled NetFlow inspects only one packet in every N, extrapolating totals from that subset. Exporting fewer records lowers router CPU and memory load, satisfying the constraint of reducing overhead on high-throughput interfaces where full flow accounting is impractical.
- ✗
Flexible NetFlow can export user-defined flow keys using NetFlow v5 format.
Why it's wrong here
Flexible NetFlow exports user-defined flow keys only through NetFlow v9 or IPFIX templates; v5 uses a fixed, non-configurable record format. It is tempting because Flexible NetFlow does allow custom keys, but pairing that capability with v5 contradicts v5's rigid structure.
- ✗
NetFlow can be used as a replacement for SNMP polling for interface utilization.
Why it's wrong here
NetFlow reports per-flow traffic volumes, so it can derive interface utilisation, but it cannot replace SNMP polling for counters, errors, discards or operational state. It is tempting because flow data gives granular per-conversation visibility, yet SNMP remains the mechanism for device health metrics.
- ✗
NetFlow v9 supports only IPv4 traffic.
Why it's wrong here
NetFlow v9 is template-based and carries no address-family restriction, so it exports IPv6 flows as readily as IPv4. It is tempting because v5 genuinely is IPv4-only, and v9's templates superficially resemble v5's fixed record layout, but the version boundary is template flexibility, not protocol family.
About these practice questions
Courseiva writes every 350-401 question from scratch — 1,923 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 350-401
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which two statements about NetFlow are true? (Choose two.)
medium- A.NetFlow uses TCP port 2055 for exporting flow records.
- ✓ B.NetFlow v9 is template-based, allowing flexible and extensible flow record formats.
- ✓ C.Sampled NetFlow reduces CPU impact by analyzing only a subset of packets.
- D.NetFlow records include the full payload of each packet.
- ✓ E.NetFlow can be used for both IPv4 and IPv6 traffic monitoring.
Why B: Three statements are true: B (NetFlow v9 is template-based), C (Sampled NetFlow reduces CPU impact), and E (NetFlow can be used for IPv4 and IPv6 monitoring). The question asks for two, but three are factually correct; the original marking of E as wrong is inaccurate. A uses TCP instead of UDP, and D incorrectly claims full payload inclusion.
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.