mediumMultiple Choice
350-401 Practice Question: Examine the following configuration: flow record…
Examine the following configuration:
flow record REC-1 match ipv4 source address match ipv4 destination address match ipv4 protocol collect interface input collect interface output collect counter bytes collect counter packets ! flow monitor MON-1 record REC-1 exporter EXPORTER-1 !
interface GigabitEthernet0/1 ip flow monitor MON-1 input
!
What is the purpose of this configuration?
⚠ Common exam trap
Cisco often tests the directional keyword ('input' vs. 'output') to see if candidates assume both directions are captured by default, when in fact only the specified direction is monitored.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It collects NetFlow data for incoming traffic, including source/destination IP, protocol, and byte/packet counts.
The configuration defines a Flexible NetFlow record (REC-1) that matches IPv4 source/destination addresses and protocol, and collects interface input/output along with byte and packet counters. The flow monitor MON-1 applies this record to incoming traffic only (ip flow monitor MON-1 input), so it collects NetFlow data exclusively for inbound packets on GigabitEthernet0/1.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
It collects NetFlow data for incoming traffic, including source/destination IP, protocol, and byte/packet counts.
Why this is correct
The Flexible NetFlow configuration defines a custom record using match statements for source IP, destination IP, and protocol, along with collect statements for byte and packet counts. The monitor is attached to the interface with the 'input' keyword, which restricts capture to ingress traffic only. This is the standard way to monitor incoming flows without affecting outbound traffic, and the collected fields directly match the description.
- ✗
It collects NetFlow data for both incoming and outgoing traffic on the interface.
Why it's wrong here
Because the monitor is applied using only the 'input' keyword, the flow collector sees only packets entering the interface. Outgoing traffic is not inspected because there is no 'output' option specified in the configuration. To monitor both directions, you would need either a second monitor for output or an explicit 'input output' configuration on the interface, so this option's claim of both directions is unsupported.
- ✗
It configures Flexible NetFlow with a user-defined record that includes TCP flags.
Why it's wrong here
Flexible NetFlow records are designed to capture only the fields explicitly listed in the match and collect statements. This record matches on IP addresses and protocol, and collects packet/byte counts, but it does not include 'match tcp flags' or any equivalent statement. Without that line, TCP flags are not recorded, so the record cannot be described as one that includes TCP flags even though it is user-defined.
- ✗
It sends flow data to the exporter using IPFIX format.
Why it's wrong here
The type of export protocol is determined by the exporter configuration (for example, 'export-protocol ipfix') or the record's protocol definition, not by the monitor itself. In this configuration, there is no explicit IPFIX keyword, and Cisco's default export protocol for Flexible NetFlow is NetFlow v9. Since the question does not indicate that the exporter has been specifically set to use IPFIX, saying the flows are sent via IPFIX is incorrect.
Go deeper
Related to this question
About these practice questions
One of 1,923 original 350-401 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.