Using NetFlow to Monitor Host Traffic and Application Types
A network administrator needs to identify which hosts are generating the most traffic on the network and what types of traffic (e.g., HTTP, FTP). Which monitoring technology should be deployed?
Quick Answer
NetFlow is the right tool here because the requirement isn't just to see how much traffic is moving, but to break that traffic down by which hosts are generating it and what kind of traffic it actually is - source and destination addresses, ports, protocols, and application-level detail. That level of granularity comes from NetFlow's design: it exports metadata about individual traffic flows rather than just raw traffic volume, which lets an administrator identify top talkers and the applications, such as HTTP or FTP, they're using. This distinguishes it from SNMP, which reports aggregate interface-level statistics like total bytes or errors on a link without any per-host or per-application breakdown, and from Syslog, which records discrete device and system events rather than ongoing traffic patterns. Because NetFlow captures the actual conversations happening across the network, it directly answers the two-part question of who is talking and what they're talking about, which neither of those other monitoring approaches can do on their own. Whenever an exam scenario asks for visibility into which specific hosts or applications are consuming bandwidth, rather than just overall link utilization or logged events, that's the cue to reach for flow-based monitoring like NetFlow instead of simpler statistical or event-logging tools.
⚠ Common exam trap
Many candidates confuse SNMP's ability to show interface utilization with the need to identify specific hosts and application types, leading them to pick SNMP when NetFlow is required for per-flow granularity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
NetFlow
NetFlow is the correct choice because it provides detailed visibility into network traffic flows, including source/destination IPs, ports, protocols, and application-level information (e.g., HTTP, FTP). Unlike SNMP, which only gives aggregate interface statistics, or Syslog, which logs device events, NetFlow captures per-flow metadata that directly answers the question of which hosts are generating the most traffic and what types of traffic they are using.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SNMP
Why it's wrong here
Incorrect. SNMP provides aggregate interface statistics but does not identify individual flows or traffic types.
When this WOULD be correct
SNMP would be correct if the question asked: 'Which technology should be used to monitor the CPU utilization and interface errors on network devices?' or 'Which protocol is commonly used to collect performance metrics from routers and switches?'
- ✓
NetFlow
Why this is correct
Correct. NetFlow collects detailed flow data, allowing identification of top talkers, applications, and traffic patterns.
- ✗
Syslog
Why it's wrong here
Incorrect. Syslog is used for logging system events and errors, not for traffic analysis.
When this WOULD be correct
A network administrator needs to centralize and analyze system logs from routers, switches, and servers for security auditing or troubleshooting. Syslog would be the correct choice for collecting and forwarding log messages.
- ✗
ICMP
Why it's wrong here
Incorrect. ICMP is used for network diagnostics like ping and traceroute, not for monitoring traffic flows.
When this WOULD be correct
When the question asks for a tool to test basic connectivity or measure round-trip time between hosts, ICMP (e.g., ping) would be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓NetFlowCorrect answer▾
Why this is correct
Correct. NetFlow collects detailed flow data, allowing identification of top talkers, applications, and traffic patterns.
✗SNMPWrong answer — click to see why▾
Why this is wrong here
SNMP is used for monitoring device health and status (e.g., CPU, memory, interface errors), not for identifying which hosts generate the most traffic or the types of traffic (e.g., HTTP, FTP). It lacks the flow-level detail required for traffic analysis.
★ When this WOULD be the correct answer
SNMP would be correct if the question asked: 'Which technology should be used to monitor the CPU utilization and interface errors on network devices?' or 'Which protocol is commonly used to collect performance metrics from routers and switches?'
Why candidates choose this
Candidates often associate SNMP with network monitoring in general, not realizing it provides aggregate statistics rather than per-flow traffic details needed to identify top talkers and application types.
✗SyslogWrong answer — click to see why▾
Why this is wrong here
Syslog is used for logging system events and messages, not for analyzing traffic volume or types like HTTP/FTP. It does not provide per-flow traffic statistics.
★ When this WOULD be the correct answer
A network administrator needs to centralize and analyze system logs from routers, switches, and servers for security auditing or troubleshooting. Syslog would be the correct choice for collecting and forwarding log messages.
Why candidates choose this
Candidates may confuse Syslog with monitoring tools because it is commonly used for network device monitoring, but it lacks traffic flow analysis capabilities.
✗ICMPWrong answer — click to see why▾
Why this is wrong here
ICMP is used for network diagnostics (e.g., ping, traceroute) and cannot identify traffic volume or application types like HTTP or FTP.
★ When this WOULD be the correct answer
When the question asks for a tool to test basic connectivity or measure round-trip time between hosts, ICMP (e.g., ping) would be correct.
Why candidates choose this
Candidates may confuse ICMP with a monitoring tool because it is commonly used to check if hosts are reachable, but it lacks traffic analysis capabilities.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Network Documentation and Diagrams
Key term
IPS
An Intrusion Prevention System (IPS) is a network security device that monitors traffic in real time and automatically blocks threats before they reach your systems.
Key term
Syslog
Syslog is a standard protocol used to send and store log messages from network devices and servers to a central logging server for monitoring and troubleshooting.
About these practice questions
Courseiva writes every N10-009 question from scratch — 464 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on N10-009
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A network administrator needs to monitor network traffic to identify which hosts are consuming the most bandwidth. Which of the following tools is BEST suited for this task?
medium- ✓ A.NetFlow
- B.Syslog server
- C.SNMP trap
- D.Traceroute
Why A: NetFlow is the best tool for monitoring network traffic to identify bandwidth consumption by hosts because it collects and analyzes IP traffic flow data, providing detailed visibility into source/destination IPs, protocols, and byte counts. Unlike simple interface counters, NetFlow allows an administrator to pinpoint which specific hosts are generating the most traffic, making it ideal for bandwidth usage analysis.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.