N10-009 Network Operations Practice Question
A network administrator is configuring a monitoring system to collect metrics from network devices. The administrator needs to ensure that the monitoring system can automatically discover the devices and obtain detailed information about their configuration and status, such as interface descriptions and software versions. Which protocol is best suited for this purpose?
⚠ Common exam trap
It's easy for candidates to confuse LLDP's neighbor discovery capability with SNMP's management and monitoring functionality, mistakenly thinking LLDP can provide detailed device configuration and status information when it only advertises basic identity and capabilities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SNMP
SNMP (Simple Network Management Protocol) is the correct choice because it is specifically designed for network management and monitoring. It allows a management system to automatically discover devices (via SNMP walks or queries to MIBs) and retrieve detailed configuration and status information, such as interface descriptions and software versions, by reading OIDs from the device's MIB. This matches the requirement for automatic discovery and detailed data collection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
SNMP
Why this is correct
SNMP (especially with SNMPv2c or v3) allows a management station to query device MIBs for detailed information such as interface descriptions, software versions, and status. It can also be used for discovery by polling known community strings.
- ✗
LLDP
Why it's wrong here
Link Layer Discovery Protocol (LLDP) is a vendor-neutral Layer 2 protocol used by network devices to advertise their identity, capabilities, and port information to directly connected neighbors. It facilitates network topology discovery and troubleshooting by allowing devices to learn about their immediate connections. While useful for mapping adjacent devices, LLDP does not provide comprehensive operational metrics, configuration settings, or status information for the device itself or for devices beyond the immediate link, making it unsuitable for broad network monitoring.
When this WOULD be correct
A question asking which protocol allows network devices to advertise their identity and capabilities to directly connected neighbors for topology discovery, without requiring a management station to poll them.
- ✗
NetFlow
Why it's wrong here
NetFlow (and similar technologies like IPFIX or sFlow) is designed to collect and export IP traffic statistics, such as source/destination IP addresses, ports, protocols, and byte counts, from network devices. It provides insights into *who* is communicating with *whom* and *how much* data is being transferred, which is crucial for bandwidth monitoring and security analysis. However, it does not provide direct device operational metrics like CPU utilization, interface status, or configuration details, which are typically collected via SNMP.
When this WOULD be correct
A question asking which protocol is best for monitoring network traffic patterns, bandwidth usage, or flow-level statistics (e.g., 'A network administrator needs to analyze traffic flows to identify top talkers and application usage. Which protocol should be used?').
- ✗
Syslog
Why it's wrong here
Syslog is a standard protocol for sending system log or event messages to a central logging server. Network devices use Syslog to report events such as interface state changes, security alerts, or authentication failures, providing a chronological record of device activity. While logs can indicate operational issues, Syslog is unstructured text data and is not designed for polling specific, real-time performance metrics or retrieving configuration parameters in a programmatic, queryable format like SNMP. It's reactive event reporting, not proactive metric collection.
When this WOULD be correct
A question asking which protocol is best for centralized logging of events, errors, and alerts from network devices to a monitoring server for troubleshooting and security analysis.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓SNMPCorrect answer▾
Why this is correct
SNMP (especially with SNMPv2c or v3) allows a management station to query device MIBs for detailed information such as interface descriptions, software versions, and status. It can also be used for discovery by polling known community strings.
✗LLDPWrong answer — click to see why▾
Why this is wrong here
LLDP is used for discovering directly connected neighbors and their capabilities, but it does not provide detailed configuration or status information like interface descriptions or software versions; SNMP is designed for that purpose.
★ When this WOULD be the correct answer
A question asking which protocol allows network devices to advertise their identity and capabilities to directly connected neighbors for topology discovery, without requiring a management station to poll them.
Why candidates choose this
Candidates may confuse LLDP's neighbor discovery capability with the broader device discovery and detailed information retrieval that SNMP provides.
✗NetFlowWrong answer — click to see why▾
Why this is wrong here
NetFlow is designed for network traffic flow analysis and accounting, not for device discovery or retrieving configuration details like interface descriptions and software versions.
★ When this WOULD be the correct answer
A question asking which protocol is best for monitoring network traffic patterns, bandwidth usage, or flow-level statistics (e.g., 'A network administrator needs to analyze traffic flows to identify top talkers and application usage. Which protocol should be used?').
Why candidates choose this
Candidates may confuse NetFlow with SNMP because both are used for network monitoring, but NetFlow focuses on traffic data rather than device configuration and status.
✗SyslogWrong answer — click to see why▾
Why this is wrong here
Syslog is used for collecting and forwarding log messages from network devices, not for automatic discovery or retrieving detailed configuration and status information like interface descriptions and software versions.
★ When this WOULD be the correct answer
A question asking which protocol is best for centralized logging of events, errors, and alerts from network devices to a monitoring server for troubleshooting and security analysis.
Why candidates choose this
Candidates may confuse Syslog with SNMP because both are used for monitoring, but Syslog focuses on log messages while SNMP provides structured data retrieval and discovery.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Network Documentation and Diagrams
Key term
SNMP
A network protocol used to collect and organize information about managed devices on IP networks and to modify that information to change device behavior.
Key term
MIB
A virtual database used by SNMP to organize and store managed device parameters as a structured tree of object identifiers (OIDs).
About these practice questions
Courseiva writes every N10-009 question from scratch — 464 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.