350-401 Network Assurance Practice Question
A network administrator is analyzing NetFlow data on a Cisco IOS router to identify top talkers. The administrator notices that a large amount of traffic is being exported but the NetFlow cache is filling up quickly. Which action should the administrator take to reduce the cache size while maintaining visibility into the most significant flows?
⚠ Common exam trap
The trap here is assuming that decreasing timeouts will solve cache size issues; while it can reduce entries, it often leads to more frequent exports and lost granularity, whereas aggregation is the intended method to reduce cache size while maintaining meaningful visibility.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable NetFlow aggregation with a suitable aggregation scheme, such as protocol-port or source-prefix.
NetFlow aggregation reduces the number of flow entries by combining individual flows into aggregated records based on criteria like protocol and port or source prefix. This directly decreases cache size and export load while preserving visibility into major traffic patterns. Adjusting timeouts can have side effects such as increased export volume or incomplete data, whereas aggregation is designed to optimize cache usage without sacrificing essential visibility.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable NetFlow aggregation with a suitable aggregation scheme, such as protocol-port or source-prefix.
Why this is correct
NetFlow aggregation combines individual flows into aggregated flows based on criteria like protocol and port or source prefix. This reduces the number of entries in the cache, lowering memory usage and export volume, while still providing visibility into major traffic patterns. It is an effective way to manage cache size without losing sight of significant flows.
- ✗
Decrease the NetFlow cache timeout values for active and inactive flows.
Why it's wrong here
Decreasing timeouts causes flows to expire more quickly, which can reduce cache size, but it may also cause many short-lived flows to be exported prematurely, increasing export volume and potentially losing visibility into flows that last longer than the timeout. It does not aggregate flows and can lead to incomplete data, making it a less effective solution than aggregation.
- ✗
Increase the NetFlow cache timeout values for active and inactive flows.
Why it's wrong here
Increasing timeouts causes flows to remain in the cache longer, which would actually increase cache size and memory usage, not reduce it. Longer timeouts can be useful for capturing long-lived flows, but they exacerbate the problem of a filling cache. This action is counterproductive for reducing cache size.
- ✗
Configure NetFlow to export only ingress traffic on all interfaces.
Why it's wrong here
Exporting only ingress traffic reduces the total flow count to some extent, but it may miss important egress flows and does not fundamentally address cache size if ingress traffic is high. It also reduces visibility into bidirectional traffic patterns. Aggregation is a more targeted solution for cache reduction while preserving visibility into significant flows.
Go deeper
Related to this question
About these practice questions
One of 1,923 original 350-401 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.