mediumMultiple Choice
300-410 Practice Question: Runs the following command to troubleshoot a…
A network engineer runs the following command to troubleshoot a Flexible NetFlow issue:
R1# show flow monitor FLOW-MONITOR-1 cache format table
Cache type: Normal Cache size: 1000 Current entries: 25 High Watermark: 50
Flows added: 1234 Flows aged: 1209 - Active timeout ( 1800 secs): 100 - Inactive timeout ( 15 secs): 1100 - Event aged: 9 - Watermark aged: 0 - Emergency aged: 0
What does the output indicate?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The majority of flows are being aged due to the inactive timeout, indicating many short-lived flows.
The output shows the current state of the Flexible NetFlow cache. The high number of flows aged due to inactive timeout (1100 out of 1209) indicates that most flows are short-lived. The cache is not full (25 out of 1000 entries used), and no watermark or emergency aging has occurred. This is normal for traffic with many brief connections.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The cache is experiencing watermark aging, indicating memory pressure.
Why it's wrong here
Watermark aging counters read zero, so no memory pressure triggered that mechanism; the 1100 inactive-timeout ages dominate instead. Watermark aging only fires when the cache exceeds its high watermark, which the current 25 entries against a 1000-entry cache never approach.
- ✗
Most flows are being aged due to the active timeout, suggesting long-lived flows.
Why it's wrong here
Inactive timeout aged 1100 flows against active timeout's 100, so short-lived flows dominate; the active-timeout figure is the smaller one. Active timeout (1800 seconds) suits long-lived, persistent sessions such as bulk transfers or tunnels, where flows legitimately outlast the timer and require periodic export.
- ✓
The majority of flows are being aged due to the inactive timeout, indicating many short-lived flows.
Why this is correct
Inactive timeout accounts for 1100 of 1209 aged flows, so most entries expire after just 15 seconds of silence. That dominance directly evidences numerous short-lived flows, matching the inactive timeout constraint rather than active timeout or watermark ageing.
- ✗
Emergency aging is occurring, which means the cache is full.
Why it's wrong here
The Emergency aged counter is zero, and only 25 of 1000 cache entries are occupied, so the cache is nowhere near full. Emergency aging would be the correct diagnosis only if entries had reached cache capacity and forced premature eviction.
Go deeper
Related to this question
About these practice questions
One of 1,401 original 300-410 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 300-410
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A network engineer runs the following command to troubleshoot Flexible NetFlow cache usage: R1# show flow monitor FLOW-MONITOR-1 statistics Cache type: Normal Cache size: 1000 Current entries: 900 High Watermark: 950 Flows added: 50000 Flows aged: 49100 - Active timeout ( 1800 secs): 40000 - Inactive timeout ( 15 secs): 9000 - Event aged: 100 - Watermark aged: 0 - Emergency aged: 0 What does this output indicate?
hard- A.The cache is mostly empty and flows are aging normally.
- ✓ B.The cache is nearly full, with many long-lived flows causing active timeout aging. No watermark or emergency aging has occurred yet.
- C.Emergency aging is occurring because the cache is full.
- D.Watermark aging has occurred, indicating the cache size needs to be increased.
Why B: The output shows Current entries at 900 out of a Cache size of 1000 (90% full), with a High Watermark of 950, indicating the cache is nearly full. Active timeout aging accounts for 40,000 of the 49,100 aged flows, meaning many flows are long-lived and hitting the 1800-second active timeout. Watermark aged and Emergency aged are both 0, confirming no watermark or emergency aging has occurred yet.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.