easyMultiple Choice
350-401 Practice Question: Deploying Cisco DNA Center and wants to use…
A company is deploying Cisco DNA Center and wants to use streaming telemetry from its network devices to provide real-time visibility. The network consists of Cisco Catalyst 9000 switches running IOS-XE. The engineer needs to configure the devices to stream telemetry data to DNA Center. Which protocol should the engineer use for the telemetry transport?
⚠ Common exam trap
Cisco often tests the distinction between legacy monitoring protocols (NetFlow, SNMP, Syslog) and modern model-driven telemetry, so the trap here is that candidates may confuse NetFlow v9 (a flow export protocol) with streaming telemetry, or assume SNMPv3 is sufficient for real-time visibility, when in fact gRPC is the required transport for DNA Center's telemetry pipeline.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
gRPC (Google Remote Procedure Call).
Cisco DNA Center uses gRPC (Google Remote Procedure Call) as the transport protocol for model-driven telemetry from IOS-XE devices like the Catalyst 9000 series. gRPC leverages HTTP/2 and Protocol Buffers to efficiently stream structured YANG-modeled data, providing the real-time visibility required by DNA Center. This is the standard method for streaming telemetry in modern Cisco SD-Access and intent-based networking architectures.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
gRPC (Google Remote Procedure Call).
Why this is correct
gRPC (Google Remote Procedure Call) is the correct answer because Cisco DNA Center leverages model-driven telemetry, and gRPC is the standard transport for that telemetry. It uses protocol buffers to encode structured YANG data and supports high-frequency, push-based subscriptions over HTTP/2. This allows DNA Center to stream interface counters, CPU/memory utilization, and other operational state from devices in near real-time, eliminating the need for repeated polling.
- ✗
NetFlow v9.
Why it's wrong here
NetFlow v9 is incorrect because it is a flow-export protocol designed specifically for recording and exporting IP traffic statistics, such as source/destination addresses, ports, and byte counts. It does not carry device health information like interface counters, CPU load, or memory usage, which are central to system telemetry. DNA Center's streaming telemetry is based on YANG-modeled data over gRPC, not NetFlow's UDP-based flow records.
- ✗
SNMPv3.
Why it's wrong here
SNMPv3 is incorrect because it operates on a pull-based model where a management station must poll device OIDs to retrieve data, making it inefficient for high-frequency, real-time telemetry. While SNMP supports traps/informs for notifications, these are limited in structure and frequency compared to the continuous, subscription-based streaming that DNA Center requires. Modern telemetry pushes data proactively via gRPC, whereas SNMP always relies on a request-response exchange or sparse trap events.
- ✗
Syslog.
Why it's wrong here
Syslog is incorrect because it is designed for unstructured or semi-structured event messages, primarily for logging and troubleshooting, not for structured, high-frequency numerical telemetry. Syslog messages are typically sent via UDP without guaranteed delivery, and there is no subscription mechanism to receive continuous updates of interface counters or system health. DNA Center's telemetry solution depends on YANG-defined data models and gRPC's reliable, ordered streaming, which syslog cannot provide.
Go deeper
Related to this question
Learn chapter
Spine-Leaf and Software-Defined Network Architectures
Key term
NETCONF Protocol
NETCONF is a network management protocol that uses a structured data format to configure, retrieve, and modify network devices in a standard, programmatic way.
Key term
Cisco SD-Access
Cisco Software-Defined Access is a network architecture that uses a central controller to automate and secure user and device access across an enterprise network.
About these practice questions
This 350-401 question is part of Courseiva's 1,923-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.