N10-009 Network Operations Practice Question
A network administrator needs to analyze bandwidth utilization and application traffic patterns on a WAN link. The administrator requires detailed flow-level data, including source/destination IP addresses, ports, and protocol. Which technology should be deployed?
⚠ Common exam trap
CompTIA often tests the distinction between SNMP and NetFlow, where candidates mistakenly choose SNMP because they think it provides detailed traffic analysis, but SNMP only gives aggregate interface counters, not per-flow data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
NetFlow
NetFlow is the correct choice because it provides detailed flow-level data, including source/destination IP addresses, ports, and protocol information, which is essential for analyzing bandwidth utilization and application traffic patterns on a WAN link. Unlike simpler monitoring tools, NetFlow captures metadata about each network flow, allowing administrators to identify which applications and hosts are consuming bandwidth.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SNMP
Why it's wrong here
SNMP (Simple Network Management Protocol) is a widely used protocol for managing and monitoring network devices. While SNMP can poll devices for interface statistics like total bytes in/out or packet counts, it provides only aggregate data at the interface level. It lacks the capability to identify individual network conversations, specific source/destination IP addresses, port numbers, or application protocols, which are essential for detailed traffic pattern analysis.
When this WOULD be correct
When the question asks for monitoring device CPU/memory usage, interface errors, or overall bandwidth utilization without requiring per-flow details, SNMP is the correct choice.
- ✓
NetFlow
Why this is correct
NetFlow is a Cisco-developed protocol that exports detailed network flow records from routers and switches to a collector. These records contain crucial information such as source and destination IP addresses, ports, protocols, timestamps, and byte/packet counts for each conversation. This granular data is ideal for analyzing bandwidth utilization, identifying top talkers, understanding application traffic patterns, and detecting anomalies across the network.
- ✗
Syslog
Why it's wrong here
Syslog is a standard for sending system log or event messages to a centralized server. Network devices use Syslog to report events such as authentication failures, interface status changes, configuration modifications, or security alerts. It is designed for logging discrete events, not for continuously capturing or analyzing the flow of network traffic, nor does it provide metrics on bandwidth consumption or application usage patterns.
When this WOULD be correct
Syslog would be correct in a scenario where a network administrator needs to centralize and analyze system logs from routers, switches, firewalls, or servers for troubleshooting security events, error messages, or compliance auditing, without requiring flow-level traffic details.
- ✗
ICMP
Why it's wrong here
ICMP (Internet Control Message Protocol) is primarily used for diagnostic and error-reporting functions within an IP network, such as the `ping` and `traceroute` utilities. It provides operational messages about network reachability and path information, but it does not track ongoing data streams or provide any details about the volume, duration, or application-specific nature of user traffic flows. Therefore, it cannot analyze bandwidth utilization or application traffic patterns.
When this WOULD be correct
A question asking which protocol is used to test connectivity or measure round-trip time between two hosts, or to identify path MTU issues, would make ICMP the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓NetFlowCorrect answer▾
Why this is correct
NetFlow is a Cisco-developed protocol that exports detailed network flow records from routers and switches to a collector. These records contain crucial information such as source and destination IP addresses, ports, protocols, timestamps, and byte/packet counts for each conversation. This granular data is ideal for analyzing bandwidth utilization, identifying top talkers, understanding application traffic patterns, and detecting anomalies across the network.
✗SNMPWrong answer — click to see why▾
Why this is wrong here
SNMP provides aggregated statistics and device health metrics, not detailed flow-level data like source/destination IPs, ports, and protocols.
★ When this WOULD be the correct answer
When the question asks for monitoring device CPU/memory usage, interface errors, or overall bandwidth utilization without requiring per-flow details, SNMP is the correct choice.
Why candidates choose this
Candidates often associate SNMP with network monitoring and assume it can provide traffic analysis, but it lacks the granular flow-level data that NetFlow offers.
✗SyslogWrong answer — click to see why▾
Why this is wrong here
Syslog is used for logging system events and messages, not for capturing detailed flow-level data like source/destination IPs, ports, and protocols. It lacks the granular flow analytics required for bandwidth utilization and application traffic pattern analysis.
★ When this WOULD be the correct answer
Syslog would be correct in a scenario where a network administrator needs to centralize and analyze system logs from routers, switches, firewalls, or servers for troubleshooting security events, error messages, or compliance auditing, without requiring flow-level traffic details.
Why candidates choose this
Candidates may confuse Syslog with a monitoring tool, assuming it can provide traffic analysis because it collects data from network devices, but they overlook that Syslog is event-based and does not capture flow records.
✗ICMPWrong answer — click to see why▾
Why this is wrong here
ICMP is a network-layer protocol used for error reporting and diagnostics (e.g., ping, traceroute), not for collecting flow-level data such as source/destination IP addresses, ports, and protocol details.
★ When this WOULD be the correct answer
A question asking which protocol is used to test connectivity or measure round-trip time between two hosts, or to identify path MTU issues, would make ICMP the correct answer.
Why candidates choose this
Candidates may confuse ICMP's diagnostic capabilities with traffic analysis, or think that ICMP can provide bandwidth utilization data because it is used in tools like ping for latency checks.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Network Documentation and Diagrams
Key term
NetFlow
NetFlow is a network protocol developed by Cisco that collects and monitors IP traffic data to provide visibility into network usage, performance, and security.
Key term
Bandwidth
Bandwidth is the maximum amount of data that can travel over a network connection in a given amount of time, usually measured in bits per second.
About these practice questions
This N10-009 question is part of Courseiva's 464-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.