NetFlow and Telemetry practice questions

A network engineer is troubleshooting intermittent packet loss on a WAN link connecting two data centers. The engineer suspects that certain traffic types are being dropped but needs to confirm this without impacting production. The engineer has access to Cisco IOS-XE routers at both ends. Which approach should the engineer use to identify the specific flows being dropped?

Trap 1: Enable SNMP polling of interface counters to identify the total…

Incorrect because SNMP polling shows aggregate drops but does not provide per-flow granularity needed to identify specific traffic types.

Trap 2: Use Embedded Event Manager (EEM) to trigger on interface drops and…

Incorrect because EEM can trigger on events but does not inherently capture per-flow drop details; packet capture would be needed separately.

Trap 3: Deploy IP SLA probes to measure latency and jitter, and correlate…

Incorrect because IP SLA measures performance metrics but does not identify which specific flows are being dropped.

A
Configure Flexible NetFlow on the routers with a flow monitor that includes the 'drop' keyword to capture dropped packets per flow.
Correct because Flexible NetFlow with the 'drop' keyword allows per-flow drop monitoring, directly identifying which flows are being dropped.
B
Enable SNMP polling of interface counters to identify the total number of dropped packets on the WAN interface.
Why wrong: Incorrect because SNMP polling shows aggregate drops but does not provide per-flow granularity needed to identify specific traffic types.
C
Use Embedded Event Manager (EEM) to trigger on interface drops and capture a packet trace.
Why wrong: Incorrect because EEM can trigger on events but does not inherently capture per-flow drop details; packet capture would be needed separately.
D
Deploy IP SLA probes to measure latency and jitter, and correlate with drop events.
Why wrong: Incorrect because IP SLA measures performance metrics but does not identify which specific flows are being dropped.

Open the full BGP breakdown →

Question 2mediummultiple choice

A large enterprise is migrating from traditional SNMP-based monitoring to streaming telemetry for better scalability and real-time visibility. The network team has Cisco Nexus 9000 switches running NX-OS. They want to stream interface counters and BGP neighbor state changes to a collector. Which telemetry technology should they implement?

Trap 1: Enable NetFlow v9 on the switches and configure the collector to…

Incorrect because NetFlow is designed for flow-level traffic data, not for streaming interface counters or BGP state changes.

Trap 2: Use SNMP traps to send interface and BGP state changes to the…

Incorrect because SNMP traps are event-driven but lack the scalability and granularity for high-frequency streaming of counters.

Trap 3: Deploy IP SLA responders on the switches to measure performance and…

Incorrect because IP SLA is for active performance measurements, not for streaming device state information.

A
Configure model-driven telemetry (MDT) using gRPC or gNMI to subscribe to the desired YANG data models for interface counters and BGP state.
Correct because MDT with gRPC/gNMI provides scalable, real-time streaming of structured data from NX-OS devices.
B
Enable NetFlow v9 on the switches and configure the collector to receive flow records that include interface statistics.
Why wrong: Incorrect because NetFlow is designed for flow-level traffic data, not for streaming interface counters or BGP state changes.
C
Use SNMP traps to send interface and BGP state changes to the collector.
Why wrong: Incorrect because SNMP traps are event-driven but lack the scalability and granularity for high-frequency streaming of counters.
D
Deploy IP SLA responders on the switches to measure performance and send results via syslog.
Why wrong: Incorrect because IP SLA is for active performance measurements, not for streaming device state information.

Question 3mediummultiple choice

A network engineer is configuring NetFlow on a Cisco ISR 4451 router to analyze traffic patterns. The engineer wants to export flow data to a collector every 60 seconds. After applying the configuration, the engineer notices that the export packets are not reaching the collector. The collector is reachable via ICMP. What is the most likely cause?

Trap 1: The router is using TCP for NetFlow export, but the collector only…

Incorrect because NetFlow export uses UDP by default; TCP is not supported for NetFlow export.

Trap 2: The flow monitor is not applied to any interface, so no flows are…

Incorrect because even if no flows are collected, the export packets would be sent if the destination is configured; the issue is export reachability.

Trap 3: The 'ip flow-export timeout rate' is set too high, causing export…

Incorrect because the timeout setting affects when flows are exported, not whether export packets are sent or reach the collector.

A
The 'ip flow-export destination' command is missing or specifies an incorrect UDP port number.
Correct because the export destination must include the correct IP and UDP port; if missing or wrong, export packets won't reach the collector.
B
The router is using TCP for NetFlow export, but the collector only supports UDP.
Why wrong: Incorrect because NetFlow export uses UDP by default; TCP is not supported for NetFlow export.
C
The flow monitor is not applied to any interface, so no flows are being collected.
Why wrong: Incorrect because even if no flows are collected, the export packets would be sent if the destination is configured; the issue is export reachability.
D
The 'ip flow-export timeout rate' is set too high, causing export packets to be delayed.
Why wrong: Incorrect because the timeout setting affects when flows are exported, not whether export packets are sent or reach the collector.

Question 4hardmultiple choice

A service provider is using Cisco ASR 9000 routers and needs to collect NetFlow data from multiple customers' traffic. The engineer wants to ensure that flow records from different customers are not mixed and can be identified separately. The router supports Flexible NetFlow. What is the best approach?

Trap 1: Configure a separate flow monitor for each customer interface and…

Incorrect because if customers share an interface (e.g., MPLS VPN), separate monitors won't separate flows; also, multiple collectors add complexity.

Trap 2: Use NetFlow v9 export with the 'match ipv4 source address' field…

Incorrect because source IP alone may not uniquely identify customers if they use overlapping private IPs.

Trap 3: Enable SNMP interface polling to track per-customer traffic…

Incorrect because SNMP provides aggregate interface counters, not per-flow or per-customer granularity.

A
Define a custom flow record that includes the 'match ipv4 vlan' or 'match ipv4 vrf' field to identify each customer's traffic, and apply a single flow monitor on the shared interface.
Correct because including the VRF or VLAN match field in the flow record allows the collector to distinguish flows per customer.
B
Configure a separate flow monitor for each customer interface and export to different collectors.
Why wrong: Incorrect because if customers share an interface (e.g., MPLS VPN), separate monitors won't separate flows; also, multiple collectors add complexity.
C
Use NetFlow v9 export with the 'match ipv4 source address' field only, and rely on the collector to separate by source IP.
Why wrong: Incorrect because source IP alone may not uniquely identify customers if they use overlapping private IPs.
D
Enable SNMP interface polling to track per-customer traffic statistics.
Why wrong: Incorrect because SNMP provides aggregate interface counters, not per-flow or per-customer granularity.

Question 5mediummultiple choice

A network operations center (NOC) is deploying streaming telemetry from Cisco IOS-XE devices to a Kafka-based analytics platform. The engineer needs to ensure that the telemetry data is encoded in a compact, efficient format for high-volume streaming. Which encoding format should the engineer configure?

Trap 1: JSON encoding.

Incorrect because JSON is text-based and more verbose, increasing bandwidth and parsing overhead.

Trap 2: XML encoding.

Incorrect because XML is even more verbose than JSON, making it inefficient for high-volume streaming.

Trap 3: CSV encoding.

Incorrect because CSV is not a standard encoding for structured telemetry data and lacks schema support.

A
Google Protocol Buffers (GPB) encoding.
Correct because GPB is a binary, compact format that minimizes bandwidth and CPU usage for high-volume streaming.
B
JSON encoding.
Why wrong: Incorrect because JSON is text-based and more verbose, increasing bandwidth and parsing overhead.
C
XML encoding.
Why wrong: Incorrect because XML is even more verbose than JSON, making it inefficient for high-volume streaming.
D
CSV encoding.
Why wrong: Incorrect because CSV is not a standard encoding for structured telemetry data and lacks schema support.

Question 6hardmultiple choice

A network engineer is troubleshooting a performance issue on a Cisco Catalyst 9300 switch. The engineer suspects that a specific application is using excessive bandwidth. The switch supports Flexible NetFlow. The engineer wants to monitor only the traffic from that application without affecting the switch's CPU. What is the most efficient way to configure this?

Trap 1: Enable NetFlow on all interfaces and export all flows to the…

Incorrect because capturing all flows increases CPU usage on the switch, which may exacerbate performance issues.

Trap 2: Use SNMP to poll interface counters and calculate the bandwidth…

Incorrect because SNMP provides aggregate interface counters, not per-application granularity.

Trap 3: Configure port mirroring (SPAN) to send all traffic to an external…

Incorrect because port mirroring sends all traffic, increasing CPU load on the switch and potentially worsening performance.

A
Define a flow record that matches the specific application using NBAR or an ACL, and apply a flow monitor with a sampler rate to reduce CPU impact.
Correct because matching only the application of interest and using a sampler minimizes the number of flows processed, reducing CPU load.
B
Enable NetFlow on all interfaces and export all flows to the collector, then filter at the collector.
Why wrong: Incorrect because capturing all flows increases CPU usage on the switch, which may exacerbate performance issues.
C
Use SNMP to poll interface counters and calculate the bandwidth used by the application.
Why wrong: Incorrect because SNMP provides aggregate interface counters, not per-application granularity.
D
Configure port mirroring (SPAN) to send all traffic to an external probe for analysis.
Why wrong: Incorrect because port mirroring sends all traffic, increasing CPU load on the switch and potentially worsening performance.

Question 7easymultiple choice

A company is deploying Cisco DNA Center and wants to use streaming telemetry from its network devices to provide real-time visibility. The network consists of Cisco Catalyst 9000 switches running IOS-XE. The engineer needs to configure the devices to stream telemetry data to DNA Center. Which protocol should the engineer use for the telemetry transport?

Trap 1: NetFlow v9.

Incorrect because NetFlow is for traffic flow data, not for streaming device telemetry like interface counters or system health.

Trap 2: SNMPv3.

Incorrect because SNMP is a pull-based protocol and not used for streaming telemetry in DNA Center.

Trap 3: Syslog.

Incorrect because syslog is for event logs, not for structured, high-frequency telemetry data.

A
gRPC (Google Remote Procedure Call).
Correct because gRPC is the standard transport for model-driven telemetry in Cisco DNA Center deployments.
B
NetFlow v9.
Why wrong: Incorrect because NetFlow is for traffic flow data, not for streaming device telemetry like interface counters or system health.
C
SNMPv3.
Why wrong: Incorrect because SNMP is a pull-based protocol and not used for streaming telemetry in DNA Center.
D
Syslog.
Why wrong: Incorrect because syslog is for event logs, not for structured, high-frequency telemetry data.

Question 8hardmultiple choice

A network engineer is configuring NetFlow on a Cisco Nexus 7000 switch to monitor traffic between two data centers. The engineer wants to ensure that flow records are exported even if the export destination is temporarily unreachable. Which feature should the engineer enable?

Trap 1: Change the export protocol to TCP to ensure reliable delivery.

Incorrect because NetFlow export does not support TCP; it uses UDP exclusively.

Trap 2: Enable SNMP traps to notify the collector of flow data.

Incorrect because SNMP traps are not used for NetFlow data; they are for event notifications.

Trap 3: Configure IP SLA to monitor the collector and buffer flows locally.

Incorrect because IP SLA monitors reachability but does not buffer NetFlow records.

A
Increase the NetFlow export buffer size and configure the export retry interval.
Correct because increasing the buffer allows storing more records during outages, and retry intervals ensure re-transmission attempts.
B
Change the export protocol to TCP to ensure reliable delivery.
Why wrong: Incorrect because NetFlow export does not support TCP; it uses UDP exclusively.
C
Enable SNMP traps to notify the collector of flow data.
Why wrong: Incorrect because SNMP traps are not used for NetFlow data; they are for event notifications.
D
Configure IP SLA to monitor the collector and buffer flows locally.
Why wrong: Incorrect because IP SLA monitors reachability but does not buffer NetFlow records.

Question 9easymultiple choice

A network engineer is deploying streaming telemetry from a Cisco ASR 1000 router to a collector using gRPC. The engineer notices that the telemetry data is not being received by the collector. The router shows that the gRPC server is running and the collector is reachable. What is the most likely cause?

Trap 1: The gRPC server is configured with the wrong port number.

Incorrect because the server is running, indicating the port is correctly configured.

Trap 2: The collector is not listening on the same IP address as configured…

Incorrect because the collector is reachable, implying it is listening on the correct IP.

Trap 3: The telemetry data is encoded in GPB, but the collector expects…

Incorrect because the encoding format mismatch would cause parsing errors, but data would still be sent; the issue is no data at all.

A
No telemetry subscription is configured on the router for the desired data paths.
Correct because a subscription defines what data to stream and to which collector; without it, no data is sent.
B
The gRPC server is configured with the wrong port number.
Why wrong: Incorrect because the server is running, indicating the port is correctly configured.
C
The collector is not listening on the same IP address as configured on the router.
Why wrong: Incorrect because the collector is reachable, implying it is listening on the correct IP.
D
The telemetry data is encoded in GPB, but the collector expects JSON.
Why wrong: Incorrect because the encoding format mismatch would cause parsing errors, but data would still be sent; the issue is no data at all.

Review the full OSPF breakdown →

Question 10mediummultiple choice

A network engineer runs the following command on Router R1:

R1# show ip ospf neighbor

Neighbor ID     Pri   State           Dead Time   Address         Interface
10.0.0.2          1   FULL/DR         00:00:34    192.168.1.2     GigabitEthernet0/0
10.0.0.3          1   2WAY/DROTHER    00:00:38    192.168.1.3     GigabitEthernet0/0

Based on this output, what can be concluded?

Trap 1: The local router is the Designated Router (DR)

The local router is not listed as DR in the output; the neighbor 10.0.0.2 is the DR.

Trap 2: The local router is a DROTHER

A DROTHER would not have a FULL adjacency with the DR; it would only have 2WAY state.

Trap 3: The OSPF network type is point-to-point

Multi-access networks show DR/BDR elections; point-to-point networks do not have DR/BDR states.

A
The local router is the Designated Router (DR)
Why wrong: The local router is not listed as DR in the output; the neighbor 10.0.0.2 is the DR.
B
The local router is the Backup Designated Router (BDR)
Since the DR is 10.0.0.2 and the BDR is not shown, the local router must be the BDR because it has a FULL adjacency with the DR and a 2WAY adjacency with the DROTHER.
C
The local router is a DROTHER
Why wrong: A DROTHER would not have a FULL adjacency with the DR; it would only have 2WAY state.
D
The OSPF network type is point-to-point
Why wrong: Multi-access networks show DR/BDR elections; point-to-point networks do not have DR/BDR states.

Open the full BGP breakdown →

Question 11mediummultiple choice

A network engineer runs the following command on Router R1:

R1# show bgp summary

BGP router identifier 192.168.1.1, local AS number 65001 BGP table version is 10, main routing table version 10

Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
192.168.1.2     4        65002    1024    1020       10    0    0 00:12:34       15
192.168.1.3     4        65003    2048    2040       10    0    0 00:24:56       20

Based on this output, what can be concluded?

Trap 1: The BGP session with 192.168.1.2 is idle

Idle state would show 'Idle' or 'Active' in the State column, not a prefix count.

Trap 2: Router R1 is using iBGP with both neighbors

iBGP requires the same AS number; here the neighbors are in different AS numbers (65002, 65003), so it is eBGP.

Trap 3: The BGP table version is 10, meaning 10 prefixes are in the table

The table version is an internal counter, not the number of prefixes. The number of prefixes received is shown in the PfxRcd column.

A
Both BGP sessions are in the established state
The State/PfxRcd column shows prefix counts (15 and 20), indicating the sessions are established and exchanging routes.
B
The BGP session with 192.168.1.2 is idle
Why wrong: Idle state would show 'Idle' or 'Active' in the State column, not a prefix count.
C
Router R1 is using iBGP with both neighbors
Why wrong: iBGP requires the same AS number; here the neighbors are in different AS numbers (65002, 65003), so it is eBGP.
D
The BGP table version is 10, meaning 10 prefixes are in the table
Why wrong: The table version is an internal counter, not the number of prefixes. The number of prefixes received is shown in the PfxRcd column.

Review the full OSPF breakdown →

Question 12easymultiple choice

A network engineer runs the following command on Router R1:

R1# show ip route 192.168.2.0

Routing entry for 192.168.2.0/24 Known via "ospf 1", distance 110, metric 20, type inter area Last update from 10.0.0.2 on GigabitEthernet0/0, 00:05:23 ago Routing Descriptor Blocks:

* 10.0.0.2, via GigabitEthernet0/0, 00:05:23 ago

Route metric is 20, traffic share count is 1

Based on this output, what can be concluded?

Trap 1: The route is an OSPF intra-area route

Intra-area routes are type 'intra area', not 'inter area'.

Trap 2: The route is an OSPF external route

External routes are type 'external' and have a different metric type (E1 or E2).

Trap 3: The route is learned via EIGRP

The output shows 'Known via ospf 1', so it is OSPF, not EIGRP.

A
The route is an OSPF intra-area route
Why wrong: Intra-area routes are type 'intra area', not 'inter area'.
B
The route is an OSPF inter-area route
The output explicitly states 'type inter area', indicating it is an inter-area route.
C
The route is an OSPF external route
Why wrong: External routes are type 'external' and have a different metric type (E1 or E2).
D
The route is learned via EIGRP
Why wrong: The output shows 'Known via ospf 1', so it is OSPF, not EIGRP.

Open the full VLAN trunking answer →

Question 13easymultiple choice

A network engineer runs the following command on Switch SW1:

SW1# show vlan brief

VLAN Name                             Status    Ports

---- -------------------------------- --------- ------------------------------- 1 default active Gi0/1, Gi0/2, Gi0/3 10 Sales active Gi0/4, Gi0/5 20 Engineering active Gi0/6, Gi0/7 1002 fddi-default act/unsup 1003 token-ring-default act/unsup 1004 fddinet-default act/unsup 1005 trnet-default act/unsup

Based on this output, what can be concluded?

Trap 1: All VLANs are in the active state and supported

VLANs 1002-1005 are in 'act/unsup' state, meaning they are not supported on this platform.

Trap 2: VLAN 1 is the only VLAN with ports assigned

VLAN 1 has ports Gi0/1, Gi0/2, Gi0/3 assigned, but VLANs 10 and 20 also have ports assigned.

Trap 3: The switch is running VTP transparent mode

The output does not provide any information about VTP mode.

A
VLANs 10 and 20 are configured and have ports assigned
The output shows VLANs 10 and 20 with status 'active' and ports assigned (Gi0/4, Gi0/5 for VLAN 10; Gi0/6, Gi0/7 for VLAN 20).
B
All VLANs are in the active state and supported
Why wrong: VLANs 1002-1005 are in 'act/unsup' state, meaning they are not supported on this platform.
C
VLAN 1 is the only VLAN with ports assigned
Why wrong: VLAN 1 has ports Gi0/1, Gi0/2, Gi0/3 assigned, but VLANs 10 and 20 also have ports assigned.
D
The switch is running VTP transparent mode
Why wrong: The output does not provide any information about VTP mode.

Open the full VLAN trunking answer →

Question 14mediummultiple choice

A network engineer runs the following command on Switch SW1:

SW1# show spanning-tree vlan 10

VLAN0010 Spanning tree enabled protocol ieee Root ID Priority 32778 Address 0011.2233.4455 Cost 19 Port 1 (GigabitEthernet0/1) Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec

Bridge ID Priority 32778 (priority 32768 sys-id-ext 10) Address 0011.2233.4466 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 sec

Interface           Role Sts Cost      Prio.Nbr Type

------------------- ---- --- --------- -------- -------------------------------- Gi0/1 Root FWD 19 128.1 P2p Gi0/2 Altn BLK 19 128.2 P2p

Based on this output, what can be concluded?

Trap 1: The local switch is the root bridge for VLAN 10

The root bridge has address 0011.2233.4455, while the local switch's bridge ID has address 0011.2233.4466, so it is not the root.

Trap 2: Interface Gi0/2 is in a forwarding state

The output shows Gi0/2 is in BLK (blocking) state, not forwarding.

Trap 3: The spanning-tree mode is Rapid PVST+

The output shows 'protocol ieee', which indicates standard 802.1D STP, not Rapid PVST+ (which would show 'protocol ieee' with different port roles).

A
The local switch is the root bridge for VLAN 10
Why wrong: The root bridge has address 0011.2233.4455, while the local switch's bridge ID has address 0011.2233.4466, so it is not the root.
B
The local switch is not the root bridge for VLAN 10
The root ID shows a different MAC address than the bridge ID of the local switch, indicating the local switch is not the root.
C
Interface Gi0/2 is in a forwarding state
Why wrong: The output shows Gi0/2 is in BLK (blocking) state, not forwarding.
D
The spanning-tree mode is Rapid PVST+
Why wrong: The output shows 'protocol ieee', which indicates standard 802.1D STP, not Rapid PVST+ (which would show 'protocol ieee' with different port roles).

Read the full EtherChannel explanation →

Question 15mediummultiple choice

A network engineer runs the following command on Switch SW1:

SW1# show etherchannel summary

Flags: D - down P - bundled in port-channel I - stand-alone s - suspended H - Hot-standby (LACP only) R - Layer3 S - Layer2 U - in use N - not in use, no aggregation f - failed to allocate aggregator

M - not in use, minimum links not met u - unsuitable for bundling w - waiting to be aggregated d - default port

Number of channel-groups in use: 1 Number of aggregators: 1

Group Port-channel Protocol Ports ------+-------------+-----------+-------------------------------------------- 1 Po1(SU) LACP Gi0/1(P) Gi0/2(P) Gi0/3(D)

Based on this output, what can be concluded?

Trap 1: The EtherChannel is fully operational with three active links

Gi0/3 is down (D), so only two links are active.

Trap 2: The EtherChannel is using PAgP protocol

The output shows 'LACP' as the protocol, not PAgP.

Trap 3: The EtherChannel is a Layer 3 port-channel

The flag 'S' indicates Layer 2, not Layer 3 (which would be 'R').

A
The EtherChannel is fully operational with three active links
Why wrong: Gi0/3 is down (D), so only two links are active.
B
The EtherChannel is operational with two active links
Gi0/1 and Gi0/2 are bundled (P), and the port-channel is up (SU), so the EtherChannel is working with two links.
C
The EtherChannel is using PAgP protocol
Why wrong: The output shows 'LACP' as the protocol, not PAgP.
D
The EtherChannel is a Layer 3 port-channel
Why wrong: The flag 'S' indicates Layer 2, not Layer 3 (which would be 'R').

Question 16mediummultiple choice

A network engineer runs the following command on Router R1:

R1# show ip nat translations

Pro Inside global Inside local Outside local Outside global --- 192.168.1.10:1024 10.0.0.10:1024 203.0.113.5:80 203.0.113.5:80 tcp 192.168.1.10:1025 10.0.0.10:1025 203.0.113.5:80 203.0.113.5:80 --- 192.168.1.11:2048 10.0.0.11:2048 198.51.100.2:443 198.51.100.2:443

Based on this output, what can be concluded?

Trap 1: The router is performing static NAT

Static NAT would show a one-to-one mapping without port numbers; here we see port numbers, indicating PAT.

Trap 2: The router is performing dynamic NAT without overload

Dynamic NAT without overload would not show port numbers in the inside global column; it would show only IP addresses.

Trap 3: The router is performing destination NAT

Destination NAT would show changes to the destination address, not the source address as seen here.

A
The router is performing static NAT
Why wrong: Static NAT would show a one-to-one mapping without port numbers; here we see port numbers, indicating PAT.
B
The router is performing dynamic NAT without overload
Why wrong: Dynamic NAT without overload would not show port numbers in the inside global column; it would show only IP addresses.
C
The router is performing NAT overload (PAT)
Multiple inside local addresses (10.0.0.10 and 10.0.0.11) are using the same inside global address (192.168.1.10) with different port numbers, which is characteristic of PAT.
D
The router is performing destination NAT
Why wrong: Destination NAT would show changes to the destination address, not the source address as seen here.

Read the full MPLS explanation →

Question 17hardmultiple choice

A network engineer runs the following command on Router R1:

R1# show mpls ldp neighbor

Peer LDP Ident: 10.0.0.2:0, Local LDP Ident: 10.0.0.1:0 TCP connection: 10.0.0.2.646 - 10.0.0.1.179 State: Oper; Msgs sent/rcvd: 100/95; Downstream Up time: 00:10:00 LDP discovery sources: GigabitEthernet0/0, Src IP: 10.0.0.2 Addresses bound to peer LDP Ident:

10.0.0.2        192.168.2.2

Peer LDP Ident: 10.0.0.3:0, Local LDP Ident: 10.0.0.1:0 TCP connection: 10.0.0.3.646 - 10.0.0.1.179 State: Oper; Msgs sent/rcvd: 200/190; Downstream Up time: 00:20:00 LDP discovery sources: GigabitEthernet0/1, Src IP: 10.0.0.3 Addresses bound to peer LDP Ident:

10.0.0.3        192.168.3.3

Based on this output, what can be concluded?

Trap 1: The router is using LDP in downstream-on-demand mode

The output shows 'Downstream' mode, not 'Downstream-on-Demand'.

Trap 2: The LDP session with 10.0.0.2 is down

The state is 'Oper', so the session is up.

Trap 3: The router has only one LDP neighbor

There are two peers listed: 10.0.0.2 and 10.0.0.3.

A
The router has two LDP peers that are both operational
Both peers show 'State: Oper', indicating they are operational.
B
The router is using LDP in downstream-on-demand mode
Why wrong: The output shows 'Downstream' mode, not 'Downstream-on-Demand'.
C
The LDP session with 10.0.0.2 is down
Why wrong: The state is 'Oper', so the session is up.
D
The router has only one LDP neighbor
Why wrong: There are two peers listed: 10.0.0.2 and 10.0.0.3.

Study the full multicast explanation →

Question 18hardmultiple choice

A network engineer runs the following command on Router R1:

R1# show ip pim neighbor

PIM Neighbor Table

Neighbor Address  Interface          Uptime    Expires    Mode
10.0.0.2          GigabitEthernet0/0 00:10:00  00:01:30   Dense
10.0.0.3          GigabitEthernet0/1 00:20:00  00:01:20   Sparse

Based on this output, what can be concluded?

Trap 1: All PIM neighbors are operating in sparse mode

The neighbor 10.0.0.2 is in Dense mode, not Sparse.

Trap 2: The router is using PIM version 2 exclusively

The output does not show PIM version information.

Trap 3: The neighbor 10.0.0.3 is not a valid PIM neighbor

The neighbor is listed with uptime and expires, so it is valid.

A
All PIM neighbors are operating in sparse mode
Why wrong: The neighbor 10.0.0.2 is in Dense mode, not Sparse.
B
The router is configured with mixed PIM modes on different interfaces
One neighbor is Dense and the other is Sparse, indicating the router has interfaces in different PIM modes.
C
The router is using PIM version 2 exclusively
Why wrong: The output does not show PIM version information.
D
The neighbor 10.0.0.3 is not a valid PIM neighbor
Why wrong: The neighbor is listed with uptime and expires, so it is valid.

Question 19mediummultiple choice

Examine the following configuration snippet:

interface GigabitEthernet0/1
 ip flow monitor FLOW-MONITOR input
 ip flow monitor FLOW-MONITOR output

! flow monitor FLOW-MONITOR exporter EXPORTER-1 record netflow ipv4 original-input ! flow exporter EXPORTER-1 destination 192.168.1.100 transport udp 2055 !

What is the effect of this configuration?

Trap 1: NetFlow v5 records are sent to the collector at 192.168.1.100 on…

The record type 'netflow ipv4 original-input' does not specify version; the default is NetFlow v9.

Trap 2: IPFIX records are sent to the collector at 192.168.1.100 on UDP…

IPFIX requires the 'ipfix' record type or exporter option; this configuration uses NetFlow.

Trap 3: The configuration is missing the 'ip flow-export source' command to…

While a source interface can be configured, it is not mandatory; the router will use the egress interface IP.

A
NetFlow v9 records are sent to the collector at 192.168.1.100 on UDP port 2055.
The flow monitor uses the exporter to send NetFlow v9 records (default) to the specified collector.
B
NetFlow v5 records are sent to the collector at 192.168.1.100 on UDP port 2055.
Why wrong: The record type 'netflow ipv4 original-input' does not specify version; the default is NetFlow v9.
C
IPFIX records are sent to the collector at 192.168.1.100 on UDP port 2055.
Why wrong: IPFIX requires the 'ipfix' record type or exporter option; this configuration uses NetFlow.
D
The configuration is missing the 'ip flow-export source' command to specify the source interface.
Why wrong: While a source interface can be configured, it is not mandatory; the router will use the egress interface IP.

Question 20mediummultiple choice

Consider the following configuration:

flow exporter EXPORTER-1 destination 10.0.0.1 source Loopback0 transport udp 9996 template data timeout 60 !

Which statement about this configuration is true?

Trap 1: The exporter uses UDP port 9996 to send flow data and templates.

The 'transport udp 9996' sets the destination port for flow data, but templates are sent on the same port.

Trap 2: The source interface Loopback0 is used only for flow data, not for…

The source interface applies to all packets sent by the exporter, including templates.

Trap 3: The exporter will send template data only when a new flow is…

Templates are sent periodically based on the timeout, not only on new flows.

A
Template data records are sent every 60 seconds to the collector.
The 'template data timeout' command defines the refresh interval for template records.
B
The exporter uses UDP port 9996 to send flow data and templates.
Why wrong: The 'transport udp 9996' sets the destination port for flow data, but templates are sent on the same port.
C
The source interface Loopback0 is used only for flow data, not for templates.
Why wrong: The source interface applies to all packets sent by the exporter, including templates.
D
The exporter will send template data only when a new flow is detected.
Why wrong: Templates are sent periodically based on the timeout, not only on new flows.