N10-009 Network Operations Practice Question
A network administrator needs to analyze bandwidth usage by application and identify top talkers on the network. Which protocol or technology should be used to export detailed traffic flow information from routers and switches to a central collector?
⚠ Common exam trap
The N10-009 exam often tests the distinction between SNMP and NetFlow, where candidates mistakenly choose SNMP because they associate it with network monitoring, but SNMP lacks the per-flow granularity needed for top talker and application analysis.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
NetFlow
NetFlow is the correct choice because it is a Cisco-developed protocol designed specifically to export detailed IP traffic flow information—including source/destination IPs, ports, protocols, and byte counts—from routers and switches to a central collector for bandwidth usage analysis and top talker identification. Unlike simpler monitoring tools, NetFlow provides per-flow granularity, enabling administrators to pinpoint which applications and hosts are consuming the most bandwidth.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
NetFlow
Why this is correct
NetFlow is a Cisco-developed protocol that collects and exports IP traffic information as "flow records" from network devices. Each flow record details a unique conversation, including source/destination IP addresses, ports, protocol, and byte/packet counts. This granular data allows network administrators to analyze bandwidth usage by specific applications, identify "top talkers" consuming the most resources, and understand traffic patterns for capacity planning and security monitoring. It provides the necessary per-flow visibility to meet the question's requirements.
- ✗
SNMP
Why it's wrong here
Simple Network Management Protocol (SNMP) is primarily used for monitoring and managing network devices. It collects aggregate statistics such as interface utilization, CPU load, and memory usage, often reported as total bits or packets per second traversing an interface. While useful for high-level performance monitoring, SNMP lacks the capability to inspect individual traffic flows or identify specific applications and their associated "top talkers" because it does not provide detailed Layer 3/4 information for individual connections.
When this WOULD be correct
SNMP would be correct in a question asking for a protocol to monitor device health metrics (e.g., CPU, memory, interface errors) or to retrieve interface traffic statistics via MIB counters, not for flow-level analysis.
- ✗
ICMP
Why it's wrong here
Internet Control Message Protocol (ICMP) is a network layer protocol used for sending error messages and operational information, such as when a requested service is unavailable or a host or router cannot be reached. Common utilities like `ping` and `traceroute` rely on ICMP for network diagnostics and reachability testing. However, ICMP itself does not collect or report on application-specific traffic volume or identify individual "top talkers" consuming bandwidth; its purpose is solely for control and error signaling.
When this WOULD be correct
A question asking which protocol is used to test connectivity between two hosts or to measure round-trip time (e.g., 'Which protocol does the ping command use?').
- ✗
SMTP
Why it's wrong here
Simple Mail Transfer Protocol (SMTP) is an application layer protocol specifically designed for sending and receiving email messages between mail servers. It defines the rules for transferring email, including message formatting and delivery mechanisms. SMTP has no inherent functionality for monitoring network bandwidth, analyzing traffic flows, or identifying "top talkers" on a network; its sole purpose is email transport.
When this WOULD be correct
When the question asks about the protocol used to send email messages between mail servers, SMTP is the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓NetFlowCorrect answer▾
Why this is correct
NetFlow is a Cisco-developed protocol that collects and exports IP traffic information as "flow records" from network devices. Each flow record details a unique conversation, including source/destination IP addresses, ports, protocol, and byte/packet counts. This granular data allows network administrators to analyze bandwidth usage by specific applications, identify "top talkers" consuming the most resources, and understand traffic patterns for capacity planning and security monitoring. It provides the necessary per-flow visibility to meet the question's requirements.
✗SNMPWrong answer — click to see why▾
Why this is wrong here
SNMP is used for monitoring and managing network devices by polling or receiving traps, but it does not export detailed traffic flow information like application-level usage or top talkers. NetFlow is specifically designed for that purpose.
★ When this WOULD be the correct answer
SNMP would be correct in a question asking for a protocol to monitor device health metrics (e.g., CPU, memory, interface errors) or to retrieve interface traffic statistics via MIB counters, not for flow-level analysis.
Why candidates choose this
Candidates may confuse SNMP's ability to collect interface traffic statistics (e.g., octets) with the more detailed flow export capability of NetFlow, assuming SNMP can provide application-level data.
✗ICMPWrong answer — click to see why▾
Why this is wrong here
ICMP is used for network diagnostics (e.g., ping, traceroute) and error reporting, not for exporting detailed traffic flow data like application usage or top talkers.
★ When this WOULD be the correct answer
A question asking which protocol is used to test connectivity between two hosts or to measure round-trip time (e.g., 'Which protocol does the ping command use?').
Why candidates choose this
Candidates may confuse ICMP with network monitoring tools because ping and traceroute are commonly used for basic network troubleshooting, leading them to think ICMP can provide traffic flow details.
✗SMTPWrong answer — click to see why▾
Why this is wrong here
SMTP is used for email transmission, not for exporting network traffic flow data. It cannot provide bandwidth usage by application or identify top talkers.
★ When this WOULD be the correct answer
When the question asks about the protocol used to send email messages between mail servers, SMTP is the correct answer.
Why candidates choose this
Candidates might confuse SMTP with a protocol that 'transfers' data, or mistakenly think it can be used for network monitoring because of its role in sending messages.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Network Documentation and Diagrams
Key term
IPS
An Intrusion Prevention System (IPS) is a network security device that monitors traffic in real time and automatically blocks threats before they reach your systems.
Key term
Bandwidth
Bandwidth is the maximum amount of data that can travel over a network connection in a given amount of time, usually measured in bits per second.
About these practice questions
Courseiva writes every N10-009 question from scratch — 464 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.