N10-009 Network Operations Practice Question
A network administrator needs to collect traffic flow data from routers and switches to analyze bandwidth usage patterns. Which protocol should be implemented on the devices to export flow data to a collector?
⚠ Common exam trap
Many candidates confuse SNMP's ability to poll interface bandwidth utilization with the need for per-flow granularity, leading them to choose SNMP instead of recognizing that NetFlow is the dedicated protocol for exporting flow data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
NetFlow
NetFlow (or its standards-based equivalent, IPFIX) is the correct protocol because it is specifically designed to export traffic flow metadata—such as source/destination IPs, ports, and byte counts—from routers and switches to a collector for bandwidth usage analysis. SNMP can poll interface counters but does not provide per-flow granularity, making NetFlow the appropriate choice for detailed traffic pattern analysis.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SNMP
Why it's wrong here
Simple Network Management Protocol (SNMP) is primarily used for monitoring and managing network devices by polling for operational statistics and receiving event notifications (traps). While it can report on interface utilization, CPU load, and memory status, SNMP does not capture or export the granular, session-level details of individual traffic flows between endpoints. It focuses on device health and performance metrics rather than the specifics of network conversations.
When this WOULD be correct
A network administrator needs to monitor the CPU utilization and interface errors on routers and switches. SNMP would be the correct protocol to poll these metrics from the devices.
- ✓
NetFlow
Why this is correct
NetFlow is a Cisco-developed protocol specifically designed for collecting and exporting IP traffic flow information from network devices to a central collector. It aggregates packets into 'flows' based on common characteristics like source/destination IP addresses, ports, protocol, and Type of Service (ToS), then sends summarized records. This detailed metadata provides critical insights into network usage patterns, bandwidth consumption, and potential security anomalies, making it the ideal solution for traffic analysis.
- ✗
ICMP
Why it's wrong here
Internet Control Message Protocol (ICMP) operates at the network layer and is fundamental for reporting errors and performing diagnostic functions within an IP network. Common uses include ping for host reachability testing and traceroute for path discovery, where it conveys messages about network conditions or unreachable destinations. ICMP does not collect, aggregate, or export detailed information about ongoing traffic flows or conversations between endpoints.
When this WOULD be correct
When the question asks for a protocol to test network connectivity or measure round-trip time between devices, ICMP would be correct.
- ✗
LLDP
Why it's wrong here
Link Layer Discovery Protocol (LLDP) is a vendor-neutral Layer 2 protocol used by network devices to advertise their identity, capabilities, and port information to directly connected neighbors. Its primary function is to facilitate network topology discovery and management, allowing devices to learn about their immediate connections and their configuration. LLDP is not designed to monitor or export IP traffic flow data, focusing instead on physical and logical link characteristics.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓NetFlowCorrect answer▾
Why this is correct
NetFlow is a Cisco-developed protocol specifically designed for collecting and exporting IP traffic flow information from network devices to a central collector. It aggregates packets into 'flows' based on common characteristics like source/destination IP addresses, ports, protocol, and Type of Service (ToS), then sends summarized records. This detailed metadata provides critical insights into network usage patterns, bandwidth consumption, and potential security anomalies, making it the ideal solution for traffic analysis.
✗SNMPWrong answer — click to see why▾
Why this is wrong here
SNMP is used for monitoring and managing network devices by polling MIB variables, not for exporting traffic flow data. It lacks the ability to provide detailed per-flow information like source/destination IPs and ports.
★ When this WOULD be the correct answer
A network administrator needs to monitor the CPU utilization and interface errors on routers and switches. SNMP would be the correct protocol to poll these metrics from the devices.
Why candidates choose this
Candidates may confuse SNMP's monitoring capabilities with flow data collection, as both involve network management and data gathering.
✗ICMPWrong answer — click to see why▾
Why this is wrong here
ICMP is used for network diagnostics (e.g., ping, traceroute) and does not export traffic flow data for bandwidth usage analysis.
★ When this WOULD be the correct answer
When the question asks for a protocol to test network connectivity or measure round-trip time between devices, ICMP would be correct.
Why candidates choose this
Candidates may confuse ICMP's role in network monitoring with flow data collection, assuming any 'monitoring' protocol works for bandwidth analysis.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Network Documentation and Diagrams
Key term
Interface
An interface is a point of connection or interaction between two systems, devices, or software components that allows them to exchange information or signals.
Key term
Bandwidth
Bandwidth is the maximum amount of data that can travel over a network connection in a given amount of time, usually measured in bits per second.
About these practice questions
This N10-009 question is part of Courseiva's 464-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.