N10-009 Network Operations Practice Question
An NOC technician observes that the average latency on a critical WAN link has risen sharply. To determine which applications are consuming the most bandwidth and contributing to the latency, which tool should the technician use?
⚠ Common exam trap
CompTIA often tests the distinction between SNMP (which shows aggregate bandwidth) and NetFlow (which shows per-application bandwidth), leading candidates to mistakenly choose SNMP because they associate it with bandwidth monitoring, even though it cannot identify specific applications.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A) NetFlow
NetFlow is the correct tool because it provides per-flow traffic analysis, allowing the technician to identify which applications (by protocol and port) are consuming the most bandwidth on the WAN link. Unlike simple bandwidth monitors, NetFlow exports detailed records of source/destination IPs, ports, and byte counts, enabling precise identification of bandwidth-hungry applications contributing to increased latency.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A) NetFlow
Why this is correct
NetFlow is a network protocol developed by Cisco that collects IP traffic information as it enters or exits a network interface. It creates "flow records" based on a set of key fields, including source/destination IP addresses, ports, protocol, and ToS byte. This data allows for detailed analysis of bandwidth consumption by specific applications, users, and conversations, making it ideal for identifying the root cause of latency related to application usage. It provides granular visibility into network traffic patterns and resource utilization.
- ✗
B) SNMP
Why it's wrong here
Simple Network Management Protocol (SNMP) is used to monitor and manage network devices by polling Management Information Bases (MIBs) for various metrics. While SNMP can collect interface statistics like total bytes in/out, CPU utilization, and memory usage, it operates at a higher level, providing aggregate data. It lacks the capability to inspect individual traffic flows or identify which specific applications or protocols are consuming bandwidth, making it unsuitable for diagnosing application-specific latency.
When this WOULD be correct
SNMP would be correct if the question asked for a tool to monitor overall interface utilization, CPU load, or memory usage on network devices, or to collect basic traffic volume counters over time.
- ✗
C) Syslog
Why it's wrong here
Syslog is a standard for sending and receiving notification messages from various network devices to a central logging server. It primarily collects log data, such as system events, security alerts, configuration changes, and error messages, from routers, switches, firewalls, and servers. While crucial for operational monitoring and troubleshooting, Syslog does not provide granular per-application bandwidth usage statistics or flow-level traffic analysis, which is necessary to diagnose application-specific latency issues.
When this WOULD be correct
Syslog would be correct when the question asks for a tool to centralize and analyze log messages from network devices to troubleshoot errors, security events, or configuration changes, such as 'Which tool should be used to collect and review router crash logs?'
- ✗
D) Ping
Why it's wrong here
Ping is a basic network utility used to test the reachability of a host on an Internet Protocol (IP) network and to measure the round-trip time for messages sent from the originating host to a destination computer. It sends ICMP echo request packets and listens for echo replies, providing basic latency and packet loss information. However, Ping offers no insight into the type of traffic, the applications generating it, or the specific bandwidth consumption patterns, thus it cannot identify application-level causes of latency.
When this WOULD be correct
When the question asks for a tool to verify basic connectivity or measure round-trip latency on a link, Ping is the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓A) NetFlowCorrect answer▾
Why this is correct
NetFlow is a network protocol developed by Cisco that collects IP traffic information as it enters or exits a network interface. It creates "flow records" based on a set of key fields, including source/destination IP addresses, ports, protocol, and ToS byte. This data allows for detailed analysis of bandwidth consumption by specific applications, users, and conversations, making it ideal for identifying the root cause of latency related to application usage. It provides granular visibility into network traffic patterns and resource utilization.
✗B) SNMPWrong answer — click to see why▾
Why this is wrong here
SNMP is used for monitoring device health and traffic statistics via MIBs, but it does not provide per-application bandwidth usage or detailed flow analysis needed to identify which applications are consuming the most bandwidth.
★ When this WOULD be the correct answer
SNMP would be correct if the question asked for a tool to monitor overall interface utilization, CPU load, or memory usage on network devices, or to collect basic traffic volume counters over time.
Why candidates choose this
Candidates may confuse SNMP's ability to monitor traffic volume with the deeper application-level visibility that NetFlow provides, assuming SNMP can identify specific applications.
✗C) SyslogWrong answer — click to see why▾
Why this is wrong here
Syslog is used for logging and monitoring system events, not for analyzing bandwidth usage per application. It does not provide traffic flow data needed to identify which applications consume the most bandwidth.
★ When this WOULD be the correct answer
Syslog would be correct when the question asks for a tool to centralize and analyze log messages from network devices to troubleshoot errors, security events, or configuration changes, such as 'Which tool should be used to collect and review router crash logs?'
Why candidates choose this
Candidates may confuse Syslog as a network monitoring tool because it is commonly used alongside other monitoring systems, but it lacks the flow analysis capabilities required for bandwidth usage identification.
✗D) PingWrong answer — click to see why▾
Why this is wrong here
Ping only measures reachability and round-trip time; it cannot identify which applications are consuming bandwidth or contributing to latency.
★ When this WOULD be the correct answer
When the question asks for a tool to verify basic connectivity or measure round-trip latency on a link, Ping is the correct answer.
Why candidates choose this
Candidates may think Ping can diagnose latency issues, but it lacks the application-level visibility needed to identify bandwidth consumption by specific applications.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
NetFlow and sFlow Traffic Analysis
Key term
WAN
A Wide Area Network (WAN) is a telecommunications network that connects multiple smaller networks, like local area networks, across large geographical distances.
Key term
Latency
Latency is the time delay between a request being sent over a network and the response being received, often measured in milliseconds.
About these practice questions
One of 464 original N10-009 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.