mediumMultiple Choice
350-401 Practice Question: Consider the following configuration: flow…
Consider the following configuration:
flow monitor FM-1 exporter EXPORTER-1 record netflow ipv4 original-input cache entries 16000 !
Which statement about this configuration is correct?
⚠ Common exam trap
Cisco often tests the distinction between 'cache entries' (a count of flow records) and other cache parameters like timers or byte limits, leading candidates to confuse the number of entries with a time interval or memory size.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The flow cache can hold up to 16,000 flow entries simultaneously.
The 'cache entries 16000' command under the flow monitor specifies the maximum number of flow entries that the NetFlow cache can hold simultaneously. This is a hard limit on the size of the flow cache, not a timer or byte limit. Therefore, the flow cache can store up to 16,000 concurrent flow records before it must either export or age out older entries to make room.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The flow cache can hold up to 16,000 flow entries simultaneously.
Why this is correct
The command 'cache entries' (Cisco IOS command 'ip flow-cache entries' or 'flow-cache entries' under the flow exporter) defines the maximum number of flow records that can be held concurrently in the flow cache. The value 16,000 is the default or configured limit for the number of flow entries, each of which is a structure containing fields such as source/destination IP, source/destination port, protocol, and byte/packet counters. When this limit is reached, new flows trigger eviction of existing entries (usually the oldest or least active) to make room, but the configured size itself does not change automatically.
- ✗
The flow cache will export flows every 16,000 seconds.
Why it's wrong here
This option mistakenly interprets the number 16,000 as a time interval. Flow export timing is governed by dedicated timers—the active flow timer (default 30 minutes, which forces export for long-lived flows) and the inactive flow timer (default 15 seconds, which exports flows that have gone idle), with configurable ranges via commands like 'ip flow-cache timeout active' and 'ip flow-cache timeout inactive'. The 'cache entries' command sets a capacity, not a period, and 16,000 refers to flow record count, never to seconds.
- ✗
The flow cache will store only 16,000 bytes of flow data.
Why it's wrong here
This option incorrectly equates cache entries with byte capacity. Each flow entry is a fixed-size metadata record in memory, not a single byte—on Cisco devices, a flow entry can consume 64 to 128 bytes or more depending on the platform and NetFlow version (e.g., v5 vs v9), so 16,000 entries would occupy at least 1,024,000 bytes (1 MB) just for the records themselves. The command 'cache entries' specifies the number of flow records the cache can hold, not the number of bytes of flow data; byte-level storage is not the metric used for NetFlow cache sizing.
- ✗
The flow cache will automatically increase to 32,000 entries if needed.
Why it's wrong here
The flow cache size is fixed at the value configured by the 'cache entries' command; it does not dynamically grow or shrink in response to traffic load. Even if the cache approaches saturation, the device will not automatically double it to 32,000—instead, the flow processor will typically force-export existing entries or drop new flow records until space frees up, depending on platform behavior. To increase the cache above 16,000 entries, an administrator must explicitly reconfigure the command with a higher number, which resets the cache and may briefly interrupt flow collection.
Go deeper
Related to this question
About these practice questions
This 350-401 question is part of Courseiva's 1,923-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.