N10-009 Network Operations Practice Question
A network administrator needs to identify which devices are generating the most traffic on a WAN link. The administrator requires detailed flow data including source and destination IP addresses, ports, and protocols. Which technology should be deployed?
⚠ Common exam trap
Many exam-takers confuse SNMP's interface utilization data with the detailed per-flow information that only NetFlow provides, leading them to choose SNMP polling when the question explicitly asks for source/destination IPs, ports, and protocols.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
NetFlow
NetFlow is the correct technology because it provides detailed flow-level data, including source and destination IP addresses, ports, and protocols, which is exactly what the administrator needs to identify which devices are generating the most traffic on a WAN link. Unlike SNMP or Syslog, NetFlow exports metadata about network flows, allowing for granular traffic analysis and bandwidth usage per conversation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SNMP polling
Why it's wrong here
SNMP (Simple Network Management Protocol) polling retrieves aggregate statistics from network device interfaces, such as total bytes in/out, packet counts, and error rates. While useful for monitoring overall interface utilization and health, SNMP does not capture the granular details of individual traffic flows, such as source/destination IP addresses or port numbers. Therefore, it cannot identify specific devices or applications generating the most traffic, only the total volume passing through an interface.
When this WOULD be correct
A network administrator needs to monitor overall bandwidth utilization on a WAN link over time to identify trends and capacity planning needs, without requiring per-flow details.
- ✓
NetFlow
Why this is correct
NetFlow is a network protocol developed by Cisco that collects IP traffic information as it enters or exits an interface. It aggregates packets into "flows" based on common attributes such as source/destination IP addresses, ports, protocol, and Type of Service (ToS). This detailed per-flow data allows network administrators to precisely identify which specific hosts, applications, or conversations are consuming the most bandwidth on a WAN link, making it ideal for traffic analysis and anomaly detection.
- ✗
Syslog
Why it's wrong here
Syslog is a standard for sending and receiving notification messages from various network devices and applications. Its primary function is to provide event logging, security alerts, and operational status messages, such as authentication failures or interface state changes. Syslog messages do not contain detailed information about network traffic flows, such as source/destination IP addresses or bandwidth consumption, making it unsuitable for identifying top traffic generators on a WAN.
When this WOULD be correct
A network administrator needs to centralize and analyze error logs, security alerts, or system events from multiple devices (e.g., routers, firewalls, servers) for troubleshooting or compliance. Syslog would be the correct technology to deploy.
- ✗
ICMP
Why it's wrong here
ICMP (Internet Control Message Protocol) is primarily used for diagnostic and error-reporting functions within an IP network, such as determining host reachability (ping) or mapping network paths (traceroute). While essential for network troubleshooting, ICMP itself does not collect or report on the volume or characteristics of general data traffic flows. It provides no mechanism to identify which specific devices are consuming the most bandwidth on a WAN.
When this WOULD be correct
A network administrator needs to test connectivity and measure round-trip time between two devices to verify link status and latency. ICMP echo requests and replies provide this basic connectivity check.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓NetFlowCorrect answer▾
Why this is correct
NetFlow is a network protocol developed by Cisco that collects IP traffic information as it enters or exits an interface. It aggregates packets into "flows" based on common attributes such as source/destination IP addresses, ports, protocol, and Type of Service (ToS). This detailed per-flow data allows network administrators to precisely identify which specific hosts, applications, or conversations are consuming the most bandwidth on a WAN link, making it ideal for traffic analysis and anomaly detection.
✗SNMP pollingWrong answer — click to see why▾
Why this is wrong here
SNMP polling provides aggregate interface statistics (e.g., bandwidth utilization) but does not deliver detailed flow data like source/destination IPs, ports, and protocols.
★ When this WOULD be the correct answer
A network administrator needs to monitor overall bandwidth utilization on a WAN link over time to identify trends and capacity planning needs, without requiring per-flow details.
Why candidates choose this
Candidates may confuse SNMP's ability to monitor traffic volume with the detailed flow analysis provided by NetFlow, assuming SNMP can supply the same granular data.
✗SyslogWrong answer — click to see why▾
Why this is wrong here
Syslog is used for logging system messages and events, not for capturing detailed flow data like source/destination IPs, ports, and protocols. It does not provide traffic volume analysis per device.
★ When this WOULD be the correct answer
A network administrator needs to centralize and analyze error logs, security alerts, or system events from multiple devices (e.g., routers, firewalls, servers) for troubleshooting or compliance. Syslog would be the correct technology to deploy.
Why candidates choose this
Candidates may confuse Syslog with flow monitoring because both involve network device data, but Syslog focuses on event logs rather than traffic flows.
✗ICMPWrong answer — click to see why▾
Why this is wrong here
ICMP is used for diagnostic purposes like ping and traceroute, not for collecting detailed flow data such as source/destination IPs, ports, and protocols.
★ When this WOULD be the correct answer
A network administrator needs to test connectivity and measure round-trip time between two devices to verify link status and latency. ICMP echo requests and replies provide this basic connectivity check.
Why candidates choose this
Candidates may confuse ICMP with network monitoring tools because ping is commonly used to check if a device is reachable, leading them to think it can provide traffic flow details.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Network Documentation and Diagrams
Key term
NetFlow
NetFlow is a network protocol developed by Cisco that collects and monitors IP traffic data to provide visibility into network usage, performance, and security.
Key term
SNMP
A network protocol used to collect and organize information about managed devices on IP networks and to modify that information to change device behavior.
About these practice questions
This N10-009 question is part of Courseiva's 464-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.