hardMultiple Choice
300-410 Practice Question: Runs the following command to troubleshoot…
A network engineer runs the following command to troubleshoot Flexible NetFlow cache usage:
R1# show flow monitor FLOW-MONITOR-1 statistics
Cache type: Normal Cache size: 1000 Current entries: 900 High Watermark: 950 Flows added: 50000 Flows aged: 49100 - Active timeout ( 1800 secs): 40000 - Inactive timeout ( 15 secs): 9000 - Event aged: 100 - Watermark aged: 0 - Emergency aged: 0
What does this output indicate?
⚠ Common exam trap
300-410 often tests whether candidates can interpret NetFlow cache statistics — the trap is misreading 'High Watermark' as evidence of watermark aging when it is actually just a peak-usage counter, and confusing active timeout aging with emergency aging.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The cache is nearly full, with many long-lived flows causing active timeout aging. No watermark or emergency aging has occurred yet.
The output shows Current entries at 900 out of a Cache size of 1000 (90% full), with a High Watermark of 950, indicating the cache is nearly full. Active timeout aging accounts for 40,000 of the 49,100 aged flows, meaning many flows are long-lived and hitting the 1800-second active timeout. Watermark aged and Emergency aged are both 0, confirming no watermark or emergency aging has occurred yet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The cache is mostly empty and flows are aging normally.
Why it's wrong here
Current entries of 900 against a cache size of 1000 means the cache is nearly full, not mostly empty, though flows are aging via timeouts. It is tempting because aging counters are non-zero, and would be correct if current entries were far below cache size.
- ✓
The cache is nearly full, with many long-lived flows causing active timeout aging. No watermark or emergency aging has occurred yet.
Why this is correct
Current entries at 900 of 1000 show the cache nearing capacity. Active timeout aged 40000 flows, indicating many long-lived flows, while watermark and emergency counters remain zero, so no forced eviction has occurred. Inactive timeout aged the shorter flows.
- ✗
Emergency aging is occurring because the cache is full.
Why it's wrong here
Emergency aging triggers only when the cache is completely full, forcing immediate eviction of entries. Here the Emergency aged counter reads zero and current entries (900) sit below cache size (1000), so no emergency eviction has occurred. It is tempting because a high watermark of 950 signals pressure, but emergency aging is a distinct, more drastic mechanism.
- ✗
Watermark aging has occurred, indicating the cache size needs to be increased.
Why it's wrong here
The Watermark aged counter is zero, so no watermark aging has taken place; the high watermark of 950 merely records the peak occupancy reached. Watermark aging would be the relevant mechanism if entries persistently approached the configured high watermark and normal aging could not free space. Increasing cache size is not indicated by this output.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 300-410 question from scratch — 1,401 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.