hardMultiple ChoiceObjective-mapped
300-410 Practice Question: An engineer configures Flexible NetFlow with a…
An engineer configures Flexible NetFlow with a flow record that includes 'match ipv4 protocol' and 'collect counter packets'. The flow monitor is applied to an interface. 'show flow monitor name MONITOR cache' shows flows, but the packet counts are much lower than expected based on interface counters. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The flow monitor is applied only in the ingress direction, missing egress traffic.
Flexible NetFlow uses sampled NetFlow by default unless 'sampler' is explicitly configured. However, the default sampling rate is 1 (no sampling). The issue might be that the monitor is applied only in one direction (ingress or egress) while traffic is bidirectional, so only half the traffic is captured.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The flow monitor is applied only in the ingress direction, missing egress traffic.
Why this is correct
If the monitor is applied only ingress, egress packets are not counted. Applying it in both directions or using a sampler with appropriate rate can match interface counters.
- ✗
The flow record does not include 'match ipv4 source address', causing flows to be aggregated incorrectly.
Why it's wrong here
Missing match fields would cause over-aggregation, not under-counting.
- ✗
The router is using sampled NetFlow with a default sampling rate of 1:1000.
Why it's wrong here
The default sampling rate is 1 (no sampling); a sampler must be explicitly configured.
- ✗
The flow exporter is rate-limiting the export, causing cache entries to be dropped before counting.
Why it's wrong here
Export rate-limiting would affect export, not cache population.
Go deeper
Related to this question
About these practice questions
One of 1,966 original 300-410 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.