mediumMultiple ChoiceObjective-mapped
300-410 Practice Question: Configures NetFlow on a router using the legacy…
A network engineer configures NetFlow on a router using the legacy 'ip flow-export' commands. After applying 'ip route-cache flow' on an interface, 'show ip flow export' shows packets being sent, but the collector reports that all flows have a source IP of the router's management interface instead of the actual source IPs. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The 'ip flow-export source' command is set to the management interface, which becomes the source IP of export packets.
In legacy NetFlow, the 'ip flow-export source' command sets the source IP of export packets, not the flow data. The symptom described is normal; the collector sees the source IP of the export packets, not the flow source IPs. However, if the collector is misconfigured to interpret the export source as flow source, that is a collector issue. But more likely, the engineer is misreading the collector output. The question tests understanding that export source IP is not the flow source.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The 'ip flow-export source' command is set to the management interface, which becomes the source IP of export packets.
Why this is correct
The export source IP is the source of the NetFlow packets, not the flow data. The collector should display flow source IPs separately.
- ✗
The router is performing NAT on the flow data before exporting.
Why it's wrong here
NetFlow exports raw packet headers; NAT is not applied to flow records.
- ✗
The flow record is configured to match the router's interface IP as the source.
Why it's wrong here
Legacy NetFlow does not use flow records; it always exports actual source/destination IPs.
- ✗
The collector is misconfigured to display the export packet source instead of the flow source.
Why it's wrong here
While possible, the more direct cause is the export source command; the collector should still show flow source IPs correctly.
Go deeper
Related to this question
About these practice questions
One of 1,966 original 300-410 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.