hardMultiple ChoiceObjective-mapped
300-410 Practice Question: Configures Flexible NetFlow on a router that also…
A network engineer configures Flexible NetFlow on a router that also runs CoPP (Control Plane Policing). After applying the flow monitor to the ingress interface, the router's CPU spikes and management traffic (SSH, SNMP) becomes intermittent. Router R1 shows: show policy-map control-plane | include (class|police) class CoPP-MGMT police rate 10000 pps. show flow monitor FLOW-MONITOR statistics | include (Packets|Dropped) Packets dropped: 5000. What is the root cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
CoPP is rate-limiting NetFlow export packets because they are classified as management traffic, causing export failures and cache buildup.
Flexible NetFlow can generate a large number of packets for export, especially if the flow monitor is configured to export all flows. These export packets are sent from the router's control plane, and if CoPP is policing management traffic, the export packets might be classified as management traffic and dropped. However, the show output indicates that the flow monitor itself is dropping packets, which suggests that the flow monitor's cache is full or that the export process is overwhelmed. The correct answer is that the flow monitor's cache is too small, causing packets to be dropped before they can be exported, and the CPU spike is due to the export process consuming resources. But the CoPP is also rate-limiting the export packets, causing further drops. The root cause is that CoPP is rate-limiting the NetFlow export traffic, which is classified as management traffic, causing the export to fail and the cache to fill up.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The flow monitor's cache size is too small, causing packet drops and CPU spikes due to cache overflow.
Why it's wrong here
While cache size could be an issue, the CoPP policy is explicitly rate-limiting management traffic, and NetFlow export uses control plane resources.
- ✓
CoPP is rate-limiting NetFlow export packets because they are classified as management traffic, causing export failures and cache buildup.
Why this is correct
NetFlow export packets are sent from the control plane and are subject to CoPP. If the CoPP policy rate-limits management traffic, export packets will be dropped, leading to cache overflow and CPU spikes.
- ✗
The flow exporter is configured with a wrong destination IP, causing all export packets to be dropped by the router.
Why it's wrong here
The show output shows packets dropped by the flow monitor, not by the exporter.
- ✗
The flow monitor is applied in the output direction, causing a loop.
Why it's wrong here
Applying in output direction would not cause CPU spikes; it would affect traffic leaving the interface.
Go deeper
Related to this question
Learn chapter
Introduction to ENARSI Exam and Network Fundamentals
Key term
Control Plane Policing
Control Plane Policing is a Cisco security feature that protects a router or switch by rate-limiting the traffic that the device's processor must handle, preventing it from being overwhelmed.
Key term
NetFlow Configuration
NetFlow Configuration is the process of setting up Cisco devices to collect and export metadata about network traffic flows for monitoring, analysis, and troubleshooting.
About these practice questions
This 300-410 question is part of Courseiva's 1,966-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.