N10-009 Network Operations Practice Question
A network administrator needs to collect detailed data about network traffic flows, including source/destination IP addresses, ports, and protocols, to analyze bandwidth usage patterns. Which technology should be used?
⚠ Common exam trap
The N10-009 exam often tests the distinction between SNMP (which provides aggregate interface statistics) and NetFlow (which provides per-flow metadata), and the trap here is that candidates mistakenly choose SNMP because they associate it with bandwidth monitoring, without realizing it lacks the detailed flow-level fields required for the scenario.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
NetFlow
NetFlow is the correct choice because it is specifically designed to collect detailed metadata about network traffic flows, including source and destination IP addresses, ports, protocols, and byte counts. This granular flow-level data enables administrators to analyze bandwidth usage patterns, identify top talkers, and perform capacity planning. Unlike SNMP, which provides aggregate interface statistics, NetFlow exports flow records that contain the exact fields needed for deep traffic analysis.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SNMP
Why it's wrong here
Simple Network Management Protocol (SNMP) is an application-layer protocol used to manage and monitor network devices, such as routers, switches, and servers. It collects high-level statistics like CPU utilization, memory usage, and interface bandwidth counters from managed devices. While useful for overall device health and performance monitoring, SNMP does not capture the granular, per-flow details necessary to analyze individual traffic conversations or application usage patterns.
When this WOULD be correct
A network administrator needs to monitor interface utilization and error rates on routers and switches over time to identify capacity issues. SNMP polling with MIBs would be the correct technology.
- ✓
NetFlow
Why this is correct
NetFlow, developed by Cisco, is a network protocol used to collect IP traffic information as it enters or exits an interface. It aggregates packets into "flows" based on common characteristics like source/destination IP, ports, protocol, and ToS. This metadata provides deep visibility into network usage, top talkers, application performance, and security threats, making it ideal for detailed traffic flow analysis.
- ✗
Syslog
Why it's wrong here
Syslog is a standard for sending and receiving notification messages from various network devices and applications to a central logging server. These messages typically contain event-based information, such as system errors, security alerts, configuration changes, or user logins. While crucial for auditing and troubleshooting, Syslog records discrete events and does not provide continuous, aggregated data about the volume, source, destination, or duration of network traffic flows.
When this WOULD be correct
Syslog would be correct when the question asks for a method to centralize and analyze system logs from network devices, such as for security event monitoring or troubleshooting device errors, not traffic flows.
- ✗
ICMP
Why it's wrong here
The Internet Control Message Protocol (ICMP) operates at the network layer and is primarily used for diagnostic purposes and reporting errors concerning the delivery of IP packets. Examples include ping (echo request/reply) and traceroute, which help determine network reachability and path. ICMP does not collect or aggregate data about ongoing network traffic flows; it merely signals conditions or performs basic connectivity tests.
When this WOULD be correct
When the question asks for a protocol to test network connectivity or measure round-trip time (e.g., 'Which protocol does ping use?'), ICMP would be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓NetFlowCorrect answer▾
Why this is correct
NetFlow, developed by Cisco, is a network protocol used to collect IP traffic information as it enters or exits an interface. It aggregates packets into "flows" based on common characteristics like source/destination IP, ports, protocol, and ToS. This metadata provides deep visibility into network usage, top talkers, application performance, and security threats, making it ideal for detailed traffic flow analysis.
✗SNMPWrong answer — click to see why▾
Why this is wrong here
SNMP provides device-level statistics (e.g., interface utilization) but does not capture detailed flow data like source/destination IPs, ports, and protocols needed for bandwidth usage pattern analysis.
★ When this WOULD be the correct answer
A network administrator needs to monitor interface utilization and error rates on routers and switches over time to identify capacity issues. SNMP polling with MIBs would be the correct technology.
Why candidates choose this
Candidates may confuse SNMP's monitoring capabilities with flow analysis, assuming it can provide traffic details when it only offers aggregate counters.
✗SyslogWrong answer — click to see why▾
Why this is wrong here
Syslog is used for logging system messages and events, not for collecting detailed network traffic flow data like source/destination IPs, ports, and protocols. It lacks the flow-level granularity needed for bandwidth usage analysis.
★ When this WOULD be the correct answer
Syslog would be correct when the question asks for a method to centralize and analyze system logs from network devices, such as for security event monitoring or troubleshooting device errors, not traffic flows.
Why candidates choose this
Candidates may confuse Syslog with NetFlow because both involve network data collection, but Syslog is more familiar for logging and they overlook that it doesn't capture flow-level details.
✗ICMPWrong answer — click to see why▾
Why this is wrong here
ICMP is used for diagnostic and error reporting (e.g., ping, traceroute), not for collecting detailed traffic flow data like IP addresses, ports, and protocols.
★ When this WOULD be the correct answer
When the question asks for a protocol to test network connectivity or measure round-trip time (e.g., 'Which protocol does ping use?'), ICMP would be correct.
Why candidates choose this
Candidates may confuse ICMP's role in network monitoring (e.g., ping for reachability) with the need for traffic flow analysis, assuming any network tool can provide detailed data.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Network Documentation and Diagrams
Key term
Interface
An interface is a point of connection or interaction between two systems, devices, or software components that allows them to exchange information or signals.
Key term
SNMP
SNMP (Simple Network Management Protocol) is an application-layer protocol used to collect and organize information about managed devices on IP networks and to modify that information to change device behavior.
About these practice questions
One of 464 original N10-009 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.