hardMultiple Choice
300-410 Practice Question: Configures Flexible NetFlow on a router to…
A network engineer configures Flexible NetFlow on a router to monitor traffic on a trunk interface with multiple VLANs. The flow monitor is applied to the physical interface. The engineer notices that all flows show the same VLAN ID in the collector, even though traffic from different VLANs is present. What is the most likely cause?
⚠ Common exam trap
300-410 often tests whether candidates know that Flexible NetFlow exports only fields defined in the flow record, so candidates who blame interface application or encapsulation pick the wrong cause instead of the missing VLAN match field.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The flow record does not include any VLAN match fields.
Flexible NetFlow only exports fields that are explicitly included in the flow record; if the record lacks VLAN match fields such as dot1q VLAN ID or S-VLAN/C-VLAN, the collector will not receive per-VLAN data and all flows appear to share the same (or no) VLAN ID. The fix is to add the appropriate VLAN fields to the flow record's match statement. The physical interface application is not the root cause because subinterface traffic still traverses the physical interface.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The flow record does not include any VLAN match fields.
Why this is correct
Flexible NetFlow only exports fields defined in the flow record. Without a match on dot1q vlan-id or a similar VLAN field, the record cannot distinguish VLANs, so every flow reports identical or absent VLAN data despite trunk traffic.
- ✗
The trunk interface is not configured with 'switchport trunk encapsulation dot1q'.
Why it's wrong here
Encapsulation governs how trunk frames are tagged on the wire; misconfiguration would break VLAN traffic entirely rather than make every flow report one VLAN ID. It is tempting because trunk encapsulation genuinely causes VLAN visibility problems, making it correct when subinterfaces fail to pass tagged traffic at all.
- ✗
The flow monitor is applied only to the physical interface, not the subinterfaces.
Why it's wrong here
Applying the monitor to the physical interface means Flexible NetFlow reads the trunk's outer header, so all flows inherit the native VLAN ID instead of per-VLAN tags. It is tempting because subinterface-level monitoring genuinely yields per-VLAN visibility, making it correct when the monitor must distinguish traffic by VLAN.
- ✗
The collector does not support VLAN fields.
Why it's wrong here
The collector simply receives exported records; it cannot force every VLAN to report an identical ID, so this does not explain uniform values. It is tempting because collector capability genuinely limits which exported fields are stored and displayed, making it correct when records arrive with correct VLAN tags but the collector drops that field.
Visual reference
Go deeper
Related to this question
About these practice questions
This 300-410 question is part of Courseiva's 1,401-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.