N10-009 Network Operations Practice Question
A network monitoring system uses SNMP to poll interface statistics from switches every 5 minutes. This polling is causing high CPU utilization on the switches. Which of the following actions would BEST reduce the CPU load on the switches while still providing monitoring data?
⚠ Common exam trap
Test-takers frequently confuse 'reducing the scope of polling' (like disabling unused interfaces) with 'eliminating the polling mechanism itself,' but the correct answer targets the fundamental shift from pull-based (polling) to push-based (traps) communication to reduce CPU load.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use SNMP traps instead of polling
SNMP traps are push-based notifications sent by the switch only when a significant event occurs (e.g., link up/down, threshold crossing), eliminating the need for the NMS to poll every 5 minutes. This reduces CPU load because the switch no longer processes periodic GET requests, which require CPU cycles to gather interface statistics from the MIB. Traps still provide monitoring data by alerting the NMS to changes, though they may not offer the same granularity as polling for all counters.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use SNMP traps instead of polling
Why this is correct
SNMP polling requires the network monitoring system to periodically query devices, consuming CPU cycles on both the polling station and the polled device for each request and response. In contrast, SNMP traps are unsolicited notifications sent by the device *only* when a specific event or threshold is met, such as an interface going down or high utilization. This event-driven communication significantly reduces the constant overhead associated with continuous polling, thereby lowering CPU load on network devices and the monitoring system.
- ✗
Increase the SNMP community string
Why it's wrong here
The SNMP community string functions as a plaintext password or shared secret, providing a rudimentary form of authentication for read-only or read-write access to an SNMP agent. Increasing its length enhances security by making it harder to guess or brute-force, but it has absolutely no bearing on the frequency or volume of SNMP polling operations. The community string's purpose is access control, not operational efficiency or data transfer reduction.
When this WOULD be correct
This option would be correct in a scenario where the question asks for improving SNMP security, such as preventing unauthorized access to SNMP data, and the current community string is weak or default.
- ✗
Disable SNMP on unused interfaces
Why it's wrong here
Disabling SNMP on unused interfaces would indeed reduce the total volume of data collected and stored by the monitoring system, as fewer MIB objects would be available for those specific interfaces. However, this action does not alter the fundamental polling interval or the CPU resources consumed by the SNMP agent in responding to requests for *active* interfaces. The device still processes the same number of polls for its enabled interfaces, and the monitoring system still initiates those polls, meaning the core CPU load from the polling mechanism remains largely unchanged.
When this WOULD be correct
This would be correct in a scenario where the network monitoring system polls all interfaces, including many that are administratively down or not connected, causing unnecessary SNMP queries. Disabling SNMP on those unused interfaces reduces the number of OIDs polled, lowering CPU usage.
- ✗
Change the SNMP version to v1
Why it's wrong here
Changing to SNMPv1 would not alleviate CPU load because it operates on the same fundamental polling mechanism as later versions, where the manager actively requests data from agents. While SNMPv1 is simpler and lacks advanced security features like encryption found in v3, its operational model still necessitates periodic queries, generating the same type of processing overhead on both the monitoring station and the network device for each data retrieval. Therefore, it offers no reduction in the CPU cycles expended on polling.
When this WOULD be correct
A question asks which SNMP version is most compatible with legacy devices that only support v1, and security is not a concern.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓Use SNMP traps instead of pollingCorrect answer▾
Why this is correct
SNMP polling requires the network monitoring system to periodically query devices, consuming CPU cycles on both the polling station and the polled device for each request and response. In contrast, SNMP traps are unsolicited notifications sent by the device *only* when a specific event or threshold is met, such as an interface going down or high utilization. This event-driven communication significantly reduces the constant overhead associated with continuous polling, thereby lowering CPU load on network devices and the monitoring system.
✗Increase the SNMP community stringWrong answer — click to see why▾
Why this is wrong here
Increasing the SNMP community string does not reduce CPU load; it only changes the authentication string for access control. The CPU load is caused by the polling frequency, not the community string.
★ When this WOULD be the correct answer
This option would be correct in a scenario where the question asks for improving SNMP security, such as preventing unauthorized access to SNMP data, and the current community string is weak or default.
Why candidates choose this
Candidates may mistakenly think that a longer or more complex community string reduces processing overhead, or they confuse it with other performance-related settings like SNMP timeouts or retries.
✗Disable SNMP on unused interfacesWrong answer — click to see why▾
Why this is wrong here
Disabling SNMP on unused interfaces reduces the amount of data polled, but the primary cause of high CPU is the polling frequency (every 5 minutes) and the polling process itself, not the number of interfaces. Traps shift the workload to the switches only when events occur, which is more effective.
★ When this WOULD be the correct answer
This would be correct in a scenario where the network monitoring system polls all interfaces, including many that are administratively down or not connected, causing unnecessary SNMP queries. Disabling SNMP on those unused interfaces reduces the number of OIDs polled, lowering CPU usage.
Why candidates choose this
Candidates may think that reducing the number of interfaces polled directly reduces CPU load, overlooking that the polling interval and the polling mechanism itself are the main contributors. They might also confuse 'unused interfaces' with 'unnecessary polling data'.
✗Change the SNMP version to v1Wrong answer — click to see why▾
Why this is wrong here
Changing SNMP version to v1 would not reduce CPU load; v1 is less efficient and lacks security, potentially increasing processing overhead due to lack of bulk retrieval.
★ When this WOULD be the correct answer
A question asks which SNMP version is most compatible with legacy devices that only support v1, and security is not a concern.
Why candidates choose this
Candidates may think older versions are simpler and thus less resource-intensive, but SNMPv1 actually requires more polling cycles due to lack of GetBulkRequest.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Network Documentation and Diagrams
Key term
SNMP
A network protocol used to collect and organize information about managed devices on IP networks and to modify that information to change device behavior.
Key term
CPU
The Central Processing Unit (CPU) is the main electronic brain of a computer that carries out instructions from software by performing basic arithmetic, logic, control, and input/output operations.
About these practice questions
Courseiva writes every N10-009 question from scratch — 464 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.