N10-009 Network Operations Practice Question
An NOC technician observes that the CPU usage on a core switch has been consistently above 90% for the past hour. Which SNMP operation should the technician use to monitor the CPU load over time with minimal network overhead?
⚠ Common exam trap
Test-takers frequently confuse SNMP TRAP with SNMP GET, assuming that polling is necessary for monitoring, but the question explicitly asks for minimal network overhead, which traps achieve by eliminating the need for repeated requests.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SNMP TRAP
D is correct because SNMP TRAP is an unsolicited notification sent from the agent (the switch) to the NMS, which allows the NOC to receive CPU load alerts only when a threshold is exceeded, minimizing network overhead by avoiding continuous polling. In this scenario, the technician wants to monitor CPU load over time with minimal overhead, and traps provide event-driven reporting rather than periodic requests, reducing bandwidth and processing load on both the switch and the network.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SNMP GET
Why it's wrong here
SNMP GET is a polling mechanism where the Network Management System (NMS) actively requests the current value of a specific Management Information Base (MIB) object, identified by its Object Identifier (OID), from an SNMP agent. For continuous monitoring of a dynamic metric like CPU usage, the NMS would need to issue frequent GET requests. This constant polling generates significant network overhead and increases the processing load on both the NMS and the monitored device, making it inefficient for real-time event notification.
When this WOULD be correct
An SNMP GET would be correct if the technician needs to check the current CPU usage value at a specific moment, such as when verifying a one-time reading after a configuration change.
- ✗
SNMP GETNEXT
Why it's wrong here
SNMP GETNEXT is designed to retrieve the next lexicographical MIB object after a specified OID, enabling sequential traversal of MIB tables or lists. While it can retrieve multiple related values, it remains a polling operation initiated by the NMS. Using GETNEXT repeatedly to monitor a single, specific event like a CPU threshold being exceeded is inefficient, as it's not optimized for event-driven alerts and would still contribute to unnecessary network traffic and agent processing overhead.
When this WOULD be correct
A technician needs to discover all interfaces on a router by walking through the ifTable MIB. Using GETNEXT in a loop (or as part of an SNMP walk) is the correct method to retrieve the next OID value iteratively until the end of the table is reached.
- ✗
SNMP WALK
Why it's wrong here
SNMP WALK is an extended series of GETNEXT requests that systematically retrieves all MIB objects within an entire subtree. This operation is typically used for initial device discovery, inventory collection, or comprehensive configuration backups, as it pulls a large volume of data. Repeatedly performing an SNMP WALK for continuous monitoring of a single metric, such as CPU usage, would be extremely resource-intensive, generating excessive network traffic and placing an undue burden on the network and the device's SNMP agent.
When this WOULD be correct
When a technician needs to discover the entire structure of a MIB or retrieve all variables under a specific OID subtree, such as when initially configuring monitoring for a new device model, SNMP WALK is appropriate despite higher overhead.
- ✓
SNMP TRAP
Why this is correct
SNMP traps are unsolicited messages from the agent to the NMS when certain events occur (e.g., CPU threshold exceeded). They reduce overhead because the NMS does not need to poll; the agent sends data only when necessary.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓SNMP TRAPCorrect answer▾
Why this is correct
SNMP traps are unsolicited messages from the agent to the NMS when certain events occur (e.g., CPU threshold exceeded). They reduce overhead because the NMS does not need to poll; the agent sends data only when necessary.
✗SNMP GETWrong answer — click to see why▾
Why this is wrong here
SNMP GET is a poll-based operation that retrieves a single OID value at a time, requiring repeated requests to monitor CPU load over time, which increases network overhead compared to a trap-based approach.
★ When this WOULD be the correct answer
An SNMP GET would be correct if the technician needs to check the current CPU usage value at a specific moment, such as when verifying a one-time reading after a configuration change.
Why candidates choose this
Candidates often associate SNMP GET with monitoring because it is the most basic operation for retrieving data, overlooking that traps are more efficient for continuous monitoring.
✗SNMP GETNEXTWrong answer — click to see why▾
Why this is wrong here
SNMP GETNEXT is used to sequentially retrieve the next variable in a MIB tree, not for continuous monitoring with minimal overhead. It requires repeated polling, which increases network traffic, whereas SNMP TRAP allows the device to send unsolicited alerts only when thresholds are exceeded, reducing overhead.
★ When this WOULD be the correct answer
A technician needs to discover all interfaces on a router by walking through the ifTable MIB. Using GETNEXT in a loop (or as part of an SNMP walk) is the correct method to retrieve the next OID value iteratively until the end of the table is reached.
Why candidates choose this
Candidates may confuse GETNEXT with a method for continuous monitoring, thinking that repeatedly issuing GETNEXT requests can track CPU load over time, without realizing that this polling approach generates more overhead than event-driven traps.
✗SNMP WALKWrong answer — click to see why▾
Why this is wrong here
SNMP WALK retrieves a large set of OID values sequentially, generating significant network overhead and CPU load on the device, which is counterproductive for monitoring high CPU usage with minimal overhead.
★ When this WOULD be the correct answer
When a technician needs to discover the entire structure of a MIB or retrieve all variables under a specific OID subtree, such as when initially configuring monitoring for a new device model, SNMP WALK is appropriate despite higher overhead.
Why candidates choose this
Candidates may think SNMP WALK is efficient for monitoring because it can retrieve multiple values in one operation, overlooking that it generates more traffic than a single GET and is not designed for ongoing low-overhead monitoring.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Network Documentation and Diagrams
Key term
RX
RX (Receive / Receiver) is the signal path or hardware component that accepts incoming data from a network medium.
Key term
SNMP
A network protocol used to collect and organize information about managed devices on IP networks and to modify that information to change device behavior.
About these practice questions
One of 464 original N10-009 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.