hardMultiple ChoiceObjective-mapped
300-410 Practice Question: An engineer notices that NetFlow export packets…
An engineer notices that NetFlow export packets are being sent from a router but the collector reports missing data for certain flows. The engineer checks 'show ip flow export' and sees 'Exporting flows to 10.1.1.100 (2055)' with packets being sent. However, 'show flow monitor name MONITOR cache' shows many flows with zero byte counts. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The flow record includes 'collect counter packets' but not 'collect counter bytes'.
If the flow record only collects packet counts but not byte counts, the byte counter will remain zero. This is a configuration error in the flow record definition.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The flow exporter is using UDP port 2055, but the collector expects TCP.
Why it's wrong here
NetFlow uses UDP; TCP is not supported. This would not cause zero byte counts in the cache.
- ✓
The flow record includes 'collect counter packets' but not 'collect counter bytes'.
Why this is correct
Without 'collect counter bytes', the byte counter remains zero. The engineer must add this directive to the record.
- ✗
The router's CPU is overloaded, causing byte counters to not update.
Why it's wrong here
CPU overload would affect all counters, not just byte counters.
- ✗
The flow monitor is applied in egress direction, which does not support byte collection.
Why it's wrong here
Egress NetFlow supports byte collection; direction does not disable byte counters.
Go deeper
Related to this question
About these practice questions
One of 1,966 original 300-410 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 300-410
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. In Flexible NetFlow, what is the default 'collect counter bytes' setting for a flow record?
hard- A.Byte counters are collected by default.
- B.Byte counters are never collected in Flexible NetFlow.
- ✓ C.Byte counters are collected only if the flow monitor includes the 'collect counter bytes' command.
- D.Byte counters are collected by default only for IPv6 flows.
Why C: By default, byte counters are not collected unless explicitly configured with 'collect counter bytes' in the flow record.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.