How should I use these NetFlow and Flexible NetFlow practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just NetFlow and Flexible NetFlow questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the NetFlow and Flexible NetFlow domain.

300-410 · topic practice

NetFlow and Flexible NetFlow practice questions

Practise Cisco CCNP ENARSI 300-410 NetFlow and Flexible NetFlow practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: NetFlow and Flexible NetFlow

Practice 10 questions Browse domain →

What the exam tests

What to know about NetFlow and Flexible NetFlow

NetFlow and Flexible NetFlow questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common NetFlow and Flexible NetFlow exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

NetFlow and Flexible NetFlow questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full network assurance explanation →

A network engineer is troubleshooting a sudden drop in NetFlow data on a Cisco router running IOS-XE 17.x. The engineer verifies that 'ip flow-export destination 10.1.1.100 2055' is configured, and the collector is reachable. However, 'show ip flow export' shows zero packets exported. What is the most likely cause?

Trap 1: The collector IP address is incorrect.

The engineer already verified reachability, so this is unlikely.

Trap 2: The export version is set to 9 but the collector expects version 5.

Version mismatch would cause the collector to reject packets, but 'show ip flow export' would still show packets sent.

Trap 3: The router is in a VRF that is not configured for NetFlow export.

VRF-specific export configuration is needed only for VRF-aware NetFlow, but the symptom of zero exported packets points to no flow generation.

Study all NetFlow and Flexible NetFlow common traps →

A
The collector IP address is incorrect.
Why wrong: The engineer already verified reachability, so this is unlikely.
B
No flow monitor is applied to any interface.
NetFlow data is only generated when a monitor or flow is enabled on an interface; without it, no flows are exported.
C
The export version is set to 9 but the collector expects version 5.
Why wrong: Version mismatch would cause the collector to reject packets, but 'show ip flow export' would still show packets sent.
D
The router is in a VRF that is not configured for NetFlow export.
Why wrong: VRF-specific export configuration is needed only for VRF-aware NetFlow, but the symptom of zero exported packets points to no flow generation.

Full breakdown with real-world context →

Question 2mediummultiple choice

Read the full network assurance explanation →

An engineer configures Flexible NetFlow on a Cisco router to monitor traffic on GigabitEthernet0/1. The flow record is defined with 'match ipv4 source address' and 'collect counter bytes'. The flow exporter sends data to 192.168.1.10:2055. After applying the monitor to the interface, 'show flow monitor name MONITOR cache' shows zero entries. What is the most likely root cause?

Trap 1: The flow exporter is not configured with a source interface.

A missing source interface would affect export, not cache population.

Trap 2: The flow record does not include 'match ipv4 protocol'.

A record with only source address and bytes is valid; missing protocol does not prevent flow creation.

Trap 3: The collector is unreachable, causing the router to stop caching…

Unreachable collector does not stop flow cache population; flows are still generated and cached.

Study all NetFlow and Flexible NetFlow common traps →

A
The flow exporter is not configured with a source interface.
Why wrong: A missing source interface would affect export, not cache population.
B
The flow monitor is applied in the wrong direction.
If the monitor is applied ingress but traffic is egress, no flows are recorded. The engineer should check the direction.
C
The flow record does not include 'match ipv4 protocol'.
Why wrong: A record with only source address and bytes is valid; missing protocol does not prevent flow creation.
D
The collector is unreachable, causing the router to stop caching flows.
Why wrong: Unreachable collector does not stop flow cache population; flows are still generated and cached.

Full breakdown with real-world context →

Question 3hardmultiple choice

Read the full network assurance explanation →

A network engineer configures Flexible NetFlow to export traffic statistics for a VRF named CUSTOMER_A. The configuration includes 'flow exporter EXPORTER' with destination 10.10.10.10:2055 and 'vrf CUSTOMER_A' under the exporter. The flow monitor is applied to the VRF interface. However, 'show flow monitor name MONITOR cache' shows no entries for VRF traffic. What is the most likely cause?

Trap 1: The exporter is missing the 'source' interface command.

Missing source interface affects export reachability, not cache population.

Trap 2: The VRF is not configured with 'ip flow-export' commands.

VRF-aware export uses the exporter's VRF statement; separate 'ip flow-export' under VRF is not required.

Trap 3: The flow record does not match any VRF-specific fields.

Matching VRF fields is optional; flows are still generated based on standard keys.

Study all NetFlow and Flexible NetFlow common traps →

A
The exporter is missing the 'source' interface command.
Why wrong: Missing source interface affects export reachability, not cache population.
B
The flow monitor is applied to the global routing table interface instead of the VRF interface.
The monitor must be applied under the VRF interface (e.g., interface GigabitEthernet0/1.100 with encapsulation dot1q and VRF forwarding CUSTOMER_A). Applying it to the physical interface without VRF will not capture VRF traffic.
C
The VRF is not configured with 'ip flow-export' commands.
Why wrong: VRF-aware export uses the exporter's VRF statement; separate 'ip flow-export' under VRF is not required.
D
The flow record does not match any VRF-specific fields.
Why wrong: Matching VRF fields is optional; flows are still generated based on standard keys.

Full breakdown with real-world context →

Question 4hardmultiple choice

Read the full network assurance explanation →

An engineer notices that NetFlow export packets are being sent from a router but the collector reports missing data for certain flows. The engineer checks 'show ip flow export' and sees 'Exporting flows to 10.1.1.100 (2055)' with packets being sent. However, 'show flow monitor name MONITOR cache' shows many flows with zero byte counts. What is the most likely cause?

Trap 1: The flow exporter is using UDP port 2055, but the collector expects…

NetFlow uses UDP; TCP is not supported. This would not cause zero byte counts in the cache.

Trap 2: The router's CPU is overloaded, causing byte counters to not update.

CPU overload would affect all counters, not just byte counters.

Trap 3: The flow monitor is applied in egress direction, which does not…

Egress NetFlow supports byte collection; direction does not disable byte counters.

Study all NetFlow and Flexible NetFlow common traps →

A
The flow exporter is using UDP port 2055, but the collector expects TCP.
Why wrong: NetFlow uses UDP; TCP is not supported. This would not cause zero byte counts in the cache.
B
The flow record includes 'collect counter packets' but not 'collect counter bytes'.
Without 'collect counter bytes', the byte counter remains zero. The engineer must add this directive to the record.
C
The router's CPU is overloaded, causing byte counters to not update.
Why wrong: CPU overload would affect all counters, not just byte counters.
D
The flow monitor is applied in egress direction, which does not support byte collection.
Why wrong: Egress NetFlow supports byte collection; direction does not disable byte counters.

Full breakdown with real-world context →

Question 5mediummultiple choice

Read the full network assurance explanation →

A network engineer configures a Flexible NetFlow monitor to capture traffic on a router's WAN interface. The flow record includes 'match ipv4 source address', 'match ipv4 destination address', and 'collect counter bytes'. After applying the monitor, 'show flow monitor name MONITOR cache' shows flows, but the collector receives no data. 'show flow exporter name EXPORTER statistics' shows 'Export packets sent: 0'. What is the most likely cause?

Trap 1: The flow exporter is configured with the wrong destination IP…

Wrong destination would still show packets sent (to the wrong IP) in exporter statistics.

Trap 2: The flow exporter is missing the 'source' interface command.

Missing source interface would cause packets to be sent with the wrong source IP, but they would still be sent.

Trap 3: The flow cache is full, preventing new exports.

A full cache would cause drops, but exporter statistics would still show some packets sent.

Study all NetFlow and Flexible NetFlow common traps →

A
The flow exporter is configured with the wrong destination IP address.
Why wrong: Wrong destination would still show packets sent (to the wrong IP) in exporter statistics.
B
The flow monitor is not associated with any flow exporter.
The monitor must be linked to an exporter using the 'exporter' command under the flow monitor configuration. Without it, no export occurs.
C
The flow exporter is missing the 'source' interface command.
Why wrong: Missing source interface would cause packets to be sent with the wrong source IP, but they would still be sent.
D
The flow cache is full, preventing new exports.
Why wrong: A full cache would cause drops, but exporter statistics would still show some packets sent.

Full breakdown with real-world context →

Question 6hardmultiple choice

Study the full IPv6 explanation →

An engineer configures Flexible NetFlow on a router to monitor both IPv4 and IPv6 traffic. The flow record is defined with 'match ipv4 source address' and 'match ipv6 source address'. After applying the monitor to an interface, 'show flow monitor name MONITOR cache' shows only IPv4 flows. What is the most likely cause?

Trap 1: IPv6 traffic is not present on the interface.

The symptom indicates no IPv6 flows at all, which is unlikely if IPv6 is configured.

Trap 2: The interface does not have IPv6 enabled.

Even if IPv6 is enabled, the record would not capture IPv6 flows due to the mixed record.

Trap 3: The flow exporter is not configured to send IPv6 flows.

Exporters are not address-family specific; they export whatever flows are in the cache.

Study all NetFlow and Flexible NetFlow common traps →

A
IPv6 traffic is not present on the interface.
Why wrong: The symptom indicates no IPv6 flows at all, which is unlikely if IPv6 is configured.
B
The flow record cannot combine IPv4 and IPv6 match fields; separate monitors are needed.
Flexible NetFlow requires separate flow records and monitors for each address family. Mixing IPv4 and IPv6 in one record is invalid.
C
The interface does not have IPv6 enabled.
Why wrong: Even if IPv6 is enabled, the record would not capture IPv6 flows due to the mixed record.
D
The flow exporter is not configured to send IPv6 flows.
Why wrong: Exporters are not address-family specific; they export whatever flows are in the cache.

Full breakdown with real-world context →

Question 7mediummultiple choice

Read the full network assurance explanation →

A network engineer configures NetFlow on a router using the legacy 'ip flow-export' commands. After applying 'ip route-cache flow' on an interface, 'show ip flow export' shows packets being sent, but the collector reports that all flows have a source IP of the router's management interface instead of the actual source IPs. What is the most likely cause?

Trap 1: The router is performing NAT on the flow data before exporting.

NetFlow exports raw packet headers; NAT is not applied to flow records.

Trap 2: The flow record is configured to match the router's interface IP as…

Legacy NetFlow does not use flow records; it always exports actual source/destination IPs.

Trap 3: The collector is misconfigured to display the export packet source…

While possible, the more direct cause is the export source command; the collector should still show flow source IPs correctly.

Study all NetFlow and Flexible NetFlow common traps →

A
The 'ip flow-export source' command is set to the management interface, which becomes the source IP of export packets.
The export source IP is the source of the NetFlow packets, not the flow data. The collector should display flow source IPs separately.
B
The router is performing NAT on the flow data before exporting.
Why wrong: NetFlow exports raw packet headers; NAT is not applied to flow records.
C
The flow record is configured to match the router's interface IP as the source.
Why wrong: Legacy NetFlow does not use flow records; it always exports actual source/destination IPs.
D
The collector is misconfigured to display the export packet source instead of the flow source.
Why wrong: While possible, the more direct cause is the export source command; the collector should still show flow source IPs correctly.

Full breakdown with real-world context →

Question 8hardmultiple choice

Read the full network assurance explanation →

An engineer configures Flexible NetFlow with a flow record that includes 'match ipv4 protocol' and 'collect counter packets'. The flow monitor is applied to an interface. 'show flow monitor name MONITOR cache' shows flows, but the packet counts are much lower than expected based on interface counters. What is the most likely cause?

Trap 1: The flow record does not include 'match ipv4 source address',…

Missing match fields would cause over-aggregation, not under-counting.

Trap 2: The router is using sampled NetFlow with a default sampling rate of…

The default sampling rate is 1 (no sampling); a sampler must be explicitly configured.

Trap 3: The flow exporter is rate-limiting the export, causing cache…

Export rate-limiting would affect export, not cache population.

Study all NetFlow and Flexible NetFlow common traps →

A
The flow monitor is applied only in the ingress direction, missing egress traffic.
If the monitor is applied only ingress, egress packets are not counted. Applying it in both directions or using a sampler with appropriate rate can match interface counters.
B
The flow record does not include 'match ipv4 source address', causing flows to be aggregated incorrectly.
Why wrong: Missing match fields would cause over-aggregation, not under-counting.
C
The router is using sampled NetFlow with a default sampling rate of 1:1000.
Why wrong: The default sampling rate is 1 (no sampling); a sampler must be explicitly configured.
D
The flow exporter is rate-limiting the export, causing cache entries to be dropped before counting.
Why wrong: Export rate-limiting would affect export, not cache population.

Full breakdown with real-world context →

Question 9hardmultiple choice

Open the full VLAN trunking answer →

A network engineer configures Flexible NetFlow on a router to monitor traffic on a trunk interface with multiple VLANs. The flow monitor is applied to the physical interface. The engineer notices that all flows show the same VLAN ID in the collector, even though traffic from different VLANs is present. What is the most likely cause?

Trap 1: The trunk interface is not configured with 'switchport trunk…

This is a Layer 2 switch configuration; on a router, subinterfaces are used for VLAN tagging.

Trap 2: The flow monitor is applied only to the physical interface, not the…

Applying the monitor to the physical interface should capture all VLAN traffic; the issue is the record definition.

Trap 3: The collector does not support VLAN fields.

Even if the collector does not display VLAN, the router would still export it if configured.

Study all NetFlow and Flexible NetFlow common traps →

A
The flow record does not include any VLAN match fields.
Without 'match dot1q vlan' in the flow record, VLAN information is not captured, so all flows appear with the same (or zero) VLAN ID.
B
The trunk interface is not configured with 'switchport trunk encapsulation dot1q'.
Why wrong: This is a Layer 2 switch configuration; on a router, subinterfaces are used for VLAN tagging.
C
The flow monitor is applied only to the physical interface, not the subinterfaces.
Why wrong: Applying the monitor to the physical interface should capture all VLAN traffic; the issue is the record definition.
D
The collector does not support VLAN fields.
Why wrong: Even if the collector does not display VLAN, the router would still export it if configured.

Full breakdown with real-world context →

Question 10mediummultiple choice

Read the full network assurance explanation →

A network engineer runs the following command on Router R1:

R1# show flow exporter EXPORTER-1

Flow Exporter EXPORTER-1: Description: Exports to collector Export protocol: NetFlow Version 9 Transport Configuration: Destination IP address: 192.168.1.100 Source IP address: 10.0.0.1 Transport Protocol: UDP Destination Port: 2055 Source Port: 0 Collector Configuration: VRFs: Default Options Configuration: Sampler: Not configured Export Statistics: Number of Flows exported: 0 Number of Packets exported: 0 Number of Source IP address unreachable: 0 Number of Packets dropped: 0

Based on this output, what is the most likely reason that no flows are being exported?

Trap 1: The destination port is incorrect; NetFlow version 9 requires port…

NetFlow version 9 commonly uses UDP port 2055, not 9996.

Trap 2: The source IP address is not reachable from the destination.

If the source IP were unreachable, the 'Number of Source IP address unreachable' counter would increment, but it is 0.

Trap 3: The sampler is not configured, causing all packets to be dropped.

A sampler is optional; without it, all packets are sampled by default. This does not cause drops.

Study all NetFlow and Flexible NetFlow common traps →

A
The destination port is incorrect; NetFlow version 9 requires port 9996.
Why wrong: NetFlow version 9 commonly uses UDP port 2055, not 9996.
B
The flow exporter is not referenced in any flow monitor applied to an interface.
The exporter statistics show no flows exported, but no errors, meaning the exporter is idle. This typically occurs when no flow monitor using this exporter is applied to an interface.
C
The source IP address is not reachable from the destination.
Why wrong: If the source IP were unreachable, the 'Number of Source IP address unreachable' counter would increment, but it is 0.
D
The sampler is not configured, causing all packets to be dropped.
Why wrong: A sampler is optional; without it, all packets are sampled by default. This does not cause drops.

Full breakdown with real-world context →

Question 11mediummultiple choice

Read the full network assurance explanation →

A network engineer runs the following command on Router R1:

R1# show flow monitor FLOW-MONITOR-1 cache format table

Cache type: Normal Cache size: 1000 Current entries: 0 High Watermark: 0

Flows added: 0 Flows aged: 0 - Active timeout (1800 secs) 0 - Inactive timeout (15 secs) 0 - Event aged 0 - Watermark aged 0 - Emergency aged 0

Based on this output, what is the most likely problem?

Trap 1: The cache size is too small at 1000 entries.

Even with a small cache, flows would be added before aging. 0 flows added suggests no capture.

Trap 2: The active timeout is too long at 1800 seconds.

Timeout values affect aging, not the addition of flows.

Trap 3: The cache type is Normal, which requires a sampler.

Normal cache type does not require a sampler; it captures all packets.

Study all NetFlow and Flexible NetFlow common traps →

A
The cache size is too small at 1000 entries.
Why wrong: Even with a small cache, flows would be added before aging. 0 flows added suggests no capture.
B
The flow monitor is not applied to any interface.
With 0 flows added and 0 current entries, the monitor is not receiving traffic. This is typical when it is not attached to an interface.
C
The active timeout is too long at 1800 seconds.
Why wrong: Timeout values affect aging, not the addition of flows.
D
The cache type is Normal, which requires a sampler.
Why wrong: Normal cache type does not require a sampler; it captures all packets.

Full breakdown with real-world context →

Question 12mediummultiple choice

Read the full network assurance explanation →

A network engineer runs the following command on Router R1:

R1# show flow monitor FLOW-MONITOR-1 cache format table

Cache type: Normal Cache size: 1000 Current entries: 500 High Watermark: 800

Flows added: 15000 Flows aged: 14500 - Active timeout (1800 secs) 12000 - Inactive timeout (15 secs) 2500 - Event aged 0 - Watermark aged 0 - Emergency aged 0

Based on this output, what is a valid conclusion?

Trap 1: The cache is experiencing packet drops due to overflow.

Emergency aged is 0, meaning no emergency aging occurred, so no drops due to overflow.

Trap 2: The inactive timeout is set too high at 15 seconds.

15 seconds is a typical default; 2500 inactive timeouts indicate short-lived flows are also present.

Trap 3: The cache size should be increased to 2000 entries.

The high watermark is 800, below the cache size of 1000, so no immediate need to increase.

Study all NetFlow and Flexible NetFlow common traps →

A
The cache is experiencing packet drops due to overflow.
Why wrong: Emergency aged is 0, meaning no emergency aging occurred, so no drops due to overflow.
B
Most flows are long-lived, as indicated by the high number of active timeout expirations.
Active timeout (1800 secs) aged 12000 flows, meaning flows lasted longer than 30 minutes, indicating long-lived traffic.
C
The inactive timeout is set too high at 15 seconds.
Why wrong: 15 seconds is a typical default; 2500 inactive timeouts indicate short-lived flows are also present.
D
The cache size should be increased to 2000 entries.
Why wrong: The high watermark is 800, below the cache size of 1000, so no immediate need to increase.

Full breakdown with real-world context →

Question 13easymultiple choice

Read the full network assurance explanation →

A network engineer runs the following command on Router R1:

R1# show flow monitor FLOW-MONITOR-1 statistics

Monitor: FLOW-MONITOR-1 Record: netflow-original Exporter: EXPORTER-1 Cache size: 1000 Current entries: 0 Flows exported: 0 Packets exported: 0

Sampler: Not configured

Flow Monitor is not attached to any interface

Based on this output, what action should the engineer take to resolve the issue?

Trap 1: Configure a sampler on the flow monitor.

A sampler is optional and not the cause of the issue.

Trap 2: Increase the cache size to 2000 entries.

Cache size is not the issue; the monitor is not attached.

Trap 3: Change the record type to netflow ipv4 original.

The record type is not the issue; the monitor is not attached.

Study all NetFlow and Flexible NetFlow common traps →

A
Configure a sampler on the flow monitor.
Why wrong: A sampler is optional and not the cause of the issue.
B
Apply the flow monitor to an interface using the 'ip flow monitor FLOW-MONITOR-1 input' command.
The flow monitor must be attached to an interface to capture traffic.
C
Increase the cache size to 2000 entries.
Why wrong: Cache size is not the issue; the monitor is not attached.
D
Change the record type to netflow ipv4 original.
Why wrong: The record type is not the issue; the monitor is not attached.

Full breakdown with real-world context →

Question 14mediummultiple choice

Read the full network assurance explanation →

A network engineer runs the following command on Router R1:

R1# show flow exporter EXPORTER-1 statistics

Flow Exporter: EXPORTER-1 Packet send statistics (last 30 seconds): Packets sent: 0 Packets dropped: 0 Packets unsent: 0

Client send statistics: Packets sent: 0 Packets dropped: 0 Packets unsent: 0

Export statistics: Number of Flows exported: 0 Number of Packets exported: 0 Number of Source IP address unreachable: 0 Number of Packets dropped (no route): 0 Number of Packets dropped (queue full): 0

Based on this output, what is the most likely cause of no exports?

Trap 1: The destination IP address is unreachable.

If unreachable, the 'Source IP address unreachable' counter would increment, but it is 0.

Trap 2: The UDP port is blocked by a firewall.

A firewall block would not be reflected in these counters; packets would still be sent but lost.

Trap 3: The source IP address is not configured on any interface.

If the source IP were not configured, the exporter would likely fail to initialize, but the output shows it is operational.

Study all NetFlow and Flexible NetFlow common traps →

A
The destination IP address is unreachable.
Why wrong: If unreachable, the 'Source IP address unreachable' counter would increment, but it is 0.
B
The flow exporter is not referenced in any flow monitor, or the flow monitor is not attached to an interface.
No flows exported and no errors indicate the exporter is idle, which occurs when no flow monitor using it is active.
C
The UDP port is blocked by a firewall.
Why wrong: A firewall block would not be reflected in these counters; packets would still be sent but lost.
D
The source IP address is not configured on any interface.
Why wrong: If the source IP were not configured, the exporter would likely fail to initialize, but the output shows it is operational.

Full breakdown with real-world context →

Question 15hardmultiple choice

Read the full network assurance explanation →

A network engineer runs the following command on Router R1:

R1# show flow monitor FLOW-MONITOR-1 cache format table

Cache type: Normal Cache size: 1000 Current entries: 1000 High Watermark: 1000

Flows added: 50000 Flows aged: 49000 - Active timeout (1800 secs) 40000 - Inactive timeout (15 secs) 8000 - Event aged 0 - Watermark aged 1000 - Emergency aged 0

Based on this output, what is the most likely issue?

Trap 1: The active timeout is set too low at 1800 seconds.

1800 seconds is the default; the issue is cache overflow, not timeout.

Trap 2: The inactive timeout is set too low at 15 seconds.

15 seconds is default; the issue is cache overflow.

Trap 3: The flow exporter is not configured.

The exporter status is not shown; the issue is cache capacity.

Study all NetFlow and Flexible NetFlow common traps →

A
The cache size is too small, causing watermark aging and potential loss of flow data.
The cache is full and watermark aging is occurring, meaning flows are being aged out due to lack of space, which can result in incomplete export data.
B
The active timeout is set too low at 1800 seconds.
Why wrong: 1800 seconds is the default; the issue is cache overflow, not timeout.
C
The inactive timeout is set too low at 15 seconds.
Why wrong: 15 seconds is default; the issue is cache overflow.
D
The flow exporter is not configured.
Why wrong: The exporter status is not shown; the issue is cache capacity.

Full breakdown with real-world context →

Question 16easymultiple choice

Read the full network assurance explanation →

A network engineer runs the following command on Router R1:

R1# show flow interface GigabitEthernet0/1

Interface GigabitEthernet0/1

FNF: monitor Monitor: FLOW-MONITOR-1 direction: Input traffic-statistics: enabled

Based on this output, what can be concluded?

Trap 1: The flow monitor is applied to both input and output traffic.

Only input direction is shown; output would require a separate configuration.

Trap 2: Traffic statistics are disabled.

The output shows 'traffic-statistics: enabled'.

Trap 3: The flow monitor is not attached to any interface.

It is attached to GigabitEthernet0/1.

Study all NetFlow and Flexible NetFlow common traps →

A
The flow monitor is applied only to incoming traffic on this interface.
The direction is specified as 'Input', meaning only inbound traffic is monitored.
B
The flow monitor is applied to both input and output traffic.
Why wrong: Only input direction is shown; output would require a separate configuration.
C
Traffic statistics are disabled.
Why wrong: The output shows 'traffic-statistics: enabled'.
D
The flow monitor is not attached to any interface.
Why wrong: It is attached to GigabitEthernet0/1.

Full breakdown with real-world context →

Question 17hardmultiple choice

Read the full network assurance explanation →

A network engineer runs the following command on Router R1:

R1# show flow monitor FLOW-MONITOR-1 cache format table

Cache type: Normal Cache size: 1000 Current entries: 0 High Watermark: 0

Flows added: 0 Flows aged: 0 - Active timeout (1800 secs) 0 - Inactive timeout (15 secs) 0 - Event aged 0 - Watermark aged 0 - Emergency aged 0

R1# show flow interface GigabitEthernet0/1

Interface GigabitEthernet0/1

FNF: monitor Monitor: FLOW-MONITOR-1 direction: Input traffic-statistics: enabled

Based on both outputs, what is the most likely problem?

Trap 1: The flow monitor is not attached to the interface.

The interface output shows it is attached.

Trap 2: The cache size is too small.

Cache size is irrelevant when no flows are added.

Trap 3: The flow exporter is misconfigured.

Exporter configuration does not affect cache addition; the monitor captures flows regardless of exporter.

Study all NetFlow and Flexible NetFlow common traps →

A
The flow monitor is attached, but no traffic is flowing through the interface.
The monitor is correctly applied, but 0 flows added indicates no packets are being processed, likely due to no traffic.
B
The flow monitor is not attached to the interface.
Why wrong: The interface output shows it is attached.
C
The cache size is too small.
Why wrong: Cache size is irrelevant when no flows are added.
D
The flow exporter is misconfigured.
Why wrong: Exporter configuration does not affect cache addition; the monitor captures flows regardless of exporter.

Full breakdown with real-world context →

Question 18mediummultiple choice

Read the full network assurance explanation →

A network engineer runs the following command on Router R1:

R1# show flow exporter EXPORTER-1

Flow Exporter EXPORTER-1: Description: Exports to collector Export protocol: NetFlow Version 9 Transport Configuration: Destination IP address: 192.168.1.100 Source IP address: 10.0.0.1 Transport Protocol: UDP Destination Port: 2055 Source Port: 0 Collector Configuration: VRFs: Default Options Configuration: Sampler: Not configured Export Statistics: Number of Flows exported: 5000 Number of Packets exported: 250 Number of Source IP address unreachable: 10 Number of Packets dropped: 0

Based on this output, what is the most likely issue?

Trap 1: The destination IP address is unreachable.

The counter is for source IP unreachable, not destination.

Trap 2: The UDP port 2055 is blocked.

If blocked, packets would be dropped, but the drop counter is 0.

Trap 3: The exporter is not sending any packets.

250 packets have been exported.

Study all NetFlow and Flexible NetFlow common traps →

A
The destination IP address is unreachable.
Why wrong: The counter is for source IP unreachable, not destination.
B
The source IP address 10.0.0.1 is not reachable from the destination, causing some packets to fail.
The 'Source IP address unreachable' counter indicates that the source IP is not reachable from the destination, likely due to a missing route or interface issue.
C
The UDP port 2055 is blocked.
Why wrong: If blocked, packets would be dropped, but the drop counter is 0.
D
The exporter is not sending any packets.
Why wrong: 250 packets have been exported.

Full breakdown with real-world context →

Question 19mediummultiple choice

Read the full network assurance explanation →

Examine the following partial configuration on router R1:

flow record RECORD-1 match ipv4 source address match ipv4 destination address match ipv4 protocol collect counter bytes collect counter packets ! flow monitor MONITOR-1 record RECORD-1 cache timeout active 60 !

interface GigabitEthernet0/1
 ip flow monitor MONITOR-1 input

Which statement about this configuration is true?

Trap 1: The flow monitor will only export flows that have been idle for 60…

The cache timeout active command exports active flows, not idle flows. Idle timeout is configured separately.

Trap 2: The flow record is missing the 'collect transport tcp-flags'…

The flow record is valid as shown; TCP flags are optional and not required for basic flow tracking.

Trap 3: The flow monitor will not export any data because no exporter has…

While an exporter is typically needed to send data to a collector, the flow monitor can still collect and cache flows locally; export requires an exporter, but the configuration is otherwise valid.

Study all NetFlow and Flexible NetFlow common traps →

A
The flow monitor will export flow records every 60 seconds regardless of whether the flow is still active.
The cache timeout active 60 command causes active flows to be exported every 60 seconds, even if the flow is still ongoing.
B
The flow monitor will only export flows that have been idle for 60 seconds.
Why wrong: The cache timeout active command exports active flows, not idle flows. Idle timeout is configured separately.
C
The flow record is missing the 'collect transport tcp-flags' command to be valid.
Why wrong: The flow record is valid as shown; TCP flags are optional and not required for basic flow tracking.
D
The flow monitor will not export any data because no exporter has been configured.
Why wrong: While an exporter is typically needed to send data to a collector, the flow monitor can still collect and cache flows locally; export requires an exporter, but the configuration is otherwise valid.

Full breakdown with real-world context →

Question 20mediummultiple choice

Read the full network assurance explanation →

Consider the following partial configuration on router R2:

flow exporter EXPORTER-1 destination 192.168.1.100 source Loopback0 transport udp 2055 ! flow monitor MONITOR-2 exporter EXPORTER-1 record netflow ipv4 original-input cache timeout active 30 !

interface GigabitEthernet0/2
 ip flow monitor MONITOR-2 input

What is the effect of this configuration?

Trap 1: The router will export NetFlow version 5 records because the…

The record type determines the export format; 'netflow ipv4 original-input' uses NetFlow v9, not v5. The UDP port does not dictate the version.

Trap 2: The flow monitor will only collect traffic on the input direction…

The exporter is correctly applied under the flow monitor configuration with the 'exporter EXPORTER-1' command.

Trap 3: The flow monitor will export flows every 30 seconds only if the…

The 'cache timeout active 30' exports active flows every 30 seconds, not idle flows.

Study all NetFlow and Flexible NetFlow common traps →

A
The router will export NetFlow version 9 records containing IPv4 source and destination addresses, protocol, and packet/byte counts.
The record 'netflow ipv4 original-input' is a predefined Flexible NetFlow record that matches traditional NetFlow fields (source/destination IP, protocol, etc.) and exports them in NetFlow v9 format.
B
The router will export NetFlow version 5 records because the exporter uses UDP port 2055.
Why wrong: The record type determines the export format; 'netflow ipv4 original-input' uses NetFlow v9, not v5. The UDP port does not dictate the version.
C
The flow monitor will only collect traffic on the input direction of GigabitEthernet0/2, but no export will occur because the exporter is not applied to the monitor.
Why wrong: The exporter is correctly applied under the flow monitor configuration with the 'exporter EXPORTER-1' command.
D
The flow monitor will export flows every 30 seconds only if the flow is idle for that period.
Why wrong: The 'cache timeout active 30' exports active flows every 30 seconds, not idle flows.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused NetFlow and Flexible NetFlow sessions

Start a NetFlow and Flexible NetFlow only practice session

Every question in these sessions is drawn from the NetFlow and Flexible NetFlow domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all NetFlow and Flexible NetFlow questions →Mixed 300-410 session

Frequently asked questions

What does the 300-410 exam test about NetFlow and Flexible NetFlow?: NetFlow and Flexible NetFlow questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just NetFlow and Flexible NetFlow questions in a focused session?: Yes — the session launcher on this page draws every question from the NetFlow and Flexible NetFlow domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other 300-410 topics?: Use the topic links above to move to related areas, or go back to the 300-410 question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the 300-410 exam covers. They are not copied from any real exam or dump site.

NetFlow and Flexible NetFlow only

10 questions 20 questions 30 questions 50 questions

Mixed 300-410 session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All 300-410 questions NetFlow and Flexible NetFlow domain overview 300-410 exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

NetFlow and Flexible NetFlow practice questions

What to know about NetFlow and Flexible NetFlow

Common NetFlow and Flexible NetFlow exam traps

NetFlow and Flexible NetFlow questions

Track your progress over time

Start a NetFlow and Flexible NetFlow only practice session

Related 300-410 topic practice pages

Layer 3 Technologies practice questions

EIGRP Troubleshooting practice questions

OSPF Troubleshooting (v2/v3) practice questions

BGP Troubleshooting practice questions

Route Redistribution practice questions

Policy-Based Routing (PBR) practice questions

VRF-Lite practice questions

Route Maps and Route Filtering practice questions

Administrative Distance practice questions

Route Summarization practice questions

Bidirectional Forwarding Detection (BFD) practice questions

VPN Technologies practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid