N10-009 Network Operations Practice Question
A network administrator needs to monitor bandwidth utilization on a router interface in real time. Which of the following protocols is best suited for this purpose?
⚠ Common exam trap
The N10-009 exam often tests SNMP polling vs. NetFlow by framing the question around 'real-time bandwidth utilization,' leading candidates to choose NetFlow because they confuse flow analysis with interface-level utilization, but NetFlow's export delay and flow-based aggregation make it unsuitable for instantaneous per-interface bandwidth monitoring.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SNMP polling
SNMP polling is the best choice for real-time bandwidth monitoring because it allows the network management system (NMS) to actively query the router's interface MIB (e.g., ifInOctets, ifOutOctets) at short intervals, calculating utilization from the delta between successive polls. This provides near-real-time data without waiting for unsolicited events, making it ideal for live dashboards and threshold alerts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Syslog
Why it's wrong here
Syslog is a standard protocol for transmitting event messages or logs from network devices to a central logging server. Devices generate Syslog messages to report significant events, such as interface status changes (up/down), security alerts, or configuration modifications. As an event-driven notification system, Syslog is designed for reactive logging and auditing, not for the proactive, periodic collection of quantitative performance metrics like real-time bandwidth utilization.
When this WOULD be correct
Syslog would be correct for a question asking about centralized logging of router events, such as interface status changes or security alerts, where real-time bandwidth monitoring is not required.
- ✓
SNMP polling
Why this is correct
SNMP polling is the standard method for network management systems (NMS) to actively query network devices for operational data. An SNMP agent on a router maintains a Management Information Base (MIB), which contains objects representing various device statistics, including interface input/output octets and packets. By periodically sending SNMP GET requests for these specific MIB objects, an NMS can collect real-time bandwidth utilization data, enabling graphical representation and historical trending.
- ✗
NetFlow
Why it's wrong here
NetFlow is a network protocol developed by Cisco for collecting and exporting detailed IP traffic flow information from routers and switches to a NetFlow collector. It captures metadata for each conversation, including source/destination IP addresses, ports, protocols, and byte/packet counts per flow. While invaluable for traffic analysis, security forensics, and capacity planning, NetFlow provides flow-level detail rather than simple, aggregated interface utilization statistics, and its primary purpose is not real-time interface polling.
When this WOULD be correct
A network administrator needs to analyze traffic patterns and identify top talkers over a period of time. NetFlow would be the best choice for detailed flow-level visibility and historical traffic analysis.
- ✗
CDP
Why it's wrong here
Cisco Discovery Protocol (CDP) is a proprietary Layer 2 protocol used by Cisco devices to discover information about directly connected Cisco equipment. It broadcasts advertisements containing details such as device type, IOS version, capabilities, and port identifiers. While useful for network mapping and troubleshooting connectivity issues, CDP does not collect or report performance metrics like interface bandwidth utilization, making it unsuitable for real-time monitoring of traffic levels.
When this WOULD be correct
A question asking which protocol allows a network administrator to discover directly connected Cisco devices and their device IDs, platform, and IP addresses would make CDP the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓SNMP pollingCorrect answer▾
Why this is correct
SNMP polling is the standard method for network management systems (NMS) to actively query network devices for operational data. An SNMP agent on a router maintains a Management Information Base (MIB), which contains objects representing various device statistics, including interface input/output octets and packets. By periodically sending SNMP GET requests for these specific MIB objects, an NMS can collect real-time bandwidth utilization data, enabling graphical representation and historical trending.
✗SyslogWrong answer — click to see why▾
Why this is wrong here
Syslog is used for logging and event messages, not for real-time bandwidth monitoring. It does not provide polling-based utilization data.
★ When this WOULD be the correct answer
Syslog would be correct for a question asking about centralized logging of router events, such as interface status changes or security alerts, where real-time bandwidth monitoring is not required.
Why candidates choose this
Candidates may confuse Syslog as a monitoring tool because it collects logs from network devices, but it lacks the polling mechanism needed for real-time utilization metrics.
✗NetFlowWrong answer — click to see why▾
Why this is wrong here
NetFlow is designed for traffic flow analysis and capacity planning, not real-time bandwidth utilization monitoring on a router interface. It provides aggregated flow data with some delay, whereas SNMP polling offers immediate interface counters.
★ When this WOULD be the correct answer
A network administrator needs to analyze traffic patterns and identify top talkers over a period of time. NetFlow would be the best choice for detailed flow-level visibility and historical traffic analysis.
Why candidates choose this
Candidates may confuse NetFlow's traffic monitoring capabilities with real-time bandwidth monitoring, not realizing that NetFlow focuses on flow data rather than instantaneous interface utilization.
✗CDPWrong answer — click to see why▾
Why this is wrong here
CDP (Cisco Discovery Protocol) is a Layer 2 protocol used to discover directly connected Cisco devices and their capabilities, not for monitoring real-time bandwidth utilization on a router interface.
★ When this WOULD be the correct answer
A question asking which protocol allows a network administrator to discover directly connected Cisco devices and their device IDs, platform, and IP addresses would make CDP the correct answer.
Why candidates choose this
Candidates may confuse CDP with a monitoring protocol because it provides information about neighboring devices, leading them to think it can also report interface statistics like bandwidth usage.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Network Documentation and Diagrams
Key term
SNMP
A network protocol used to collect and organize information about managed devices on IP networks and to modify that information to change device behavior.
Key term
Interface
An interface is a point of connection or interaction between two systems, devices, or software components that allows them to exchange information or signals.
About these practice questions
Courseiva writes every N10-009 question from scratch — 464 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.