N10-009 Network Operations Practice Question
A network administrator needs to monitor network traffic to identify which hosts are consuming the most bandwidth. Which of the following tools is BEST suited for this task?
⚠ Common exam trap
The N10-009 exam often tests the distinction between monitoring tools by making candidates confuse SNMP (which polls interface counters for aggregate bandwidth) with NetFlow (which provides per-flow granularity for identifying specific hosts).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
NetFlow
NetFlow is the best tool for monitoring network traffic to identify bandwidth consumption by hosts because it collects and analyzes IP traffic flow data, providing detailed visibility into source/destination IPs, protocols, and byte counts. Unlike simple interface counters, NetFlow allows an administrator to pinpoint which specific hosts are generating the most traffic, making it ideal for bandwidth usage analysis.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
NetFlow
Why this is correct
NetFlow, developed by Cisco, is a network protocol that collects IP traffic information as it enters or exits an interface. It aggregates these packets into "flows" based on common characteristics like source/destination IP, ports, protocol, and ToS. This data is then exported to a NetFlow collector, which analyzes the flow records to provide detailed insights into bandwidth usage, identifying specific hosts, applications, and conversations consuming network resources. This makes it ideal for pinpointing "top talkers" and understanding traffic patterns.
- ✗
Syslog server
Why it's wrong here
A Syslog server is designed to collect, store, and manage log messages generated by various network devices, servers, and applications. These logs typically contain event notifications, error messages, security alerts, and operational status updates. While valuable for auditing, troubleshooting, and security monitoring, Syslog primarily focuses on event logging rather than continuous, granular measurement of network traffic volume or bandwidth utilization per host.
When this WOULD be correct
A syslog server would be the correct answer for a question asking: 'Which tool should be used to centrally collect and store error logs from multiple network devices for troubleshooting?'
- ✗
SNMP trap
Why it's wrong here
An SNMP trap is an asynchronous notification sent by an SNMP agent to a manager when a significant event occurs on the managed device. These unsolicited messages alert administrators to critical conditions, such as interface status changes or high CPU utilization, without requiring the manager to poll the device. However, SNMP traps are event-driven alerts and do not provide the continuous, detailed traffic flow analysis necessary to identify specific hosts consuming bandwidth.
When this WOULD be correct
A network administrator needs to receive real-time alerts when a specific interface exceeds a bandwidth threshold. SNMP traps would be configured to send notifications upon threshold violation, making them the best choice for event-driven bandwidth alerting.
- ✗
Traceroute
Why it's wrong here
Traceroute is a diagnostic utility used to display the route and measure transit delays of packets across an IP network. It operates by sending packets with incrementally increasing Time-To-Live (TTL) values, eliciting ICMP "Time Exceeded" messages from intermediate routers. While useful for troubleshooting connectivity and latency, Traceroute does not collect or analyze data related to the volume of traffic or bandwidth consumption by specific hosts on the network.
When this WOULD be correct
A question asking 'Which tool can be used to identify the path and measure latency between a source and destination across a network?' would make traceroute the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓NetFlowCorrect answer▾
Why this is correct
NetFlow, developed by Cisco, is a network protocol that collects IP traffic information as it enters or exits an interface. It aggregates these packets into "flows" based on common characteristics like source/destination IP, ports, protocol, and ToS. This data is then exported to a NetFlow collector, which analyzes the flow records to provide detailed insights into bandwidth usage, identifying specific hosts, applications, and conversations consuming network resources. This makes it ideal for pinpointing "top talkers" and understanding traffic patterns.
✗Syslog serverWrong answer — click to see why▾
Why this is wrong here
A syslog server collects and stores log messages from network devices, but it does not analyze bandwidth usage per host. It lacks the flow-level traffic analysis needed to identify top bandwidth consumers.
★ When this WOULD be the correct answer
A syslog server would be the correct answer for a question asking: 'Which tool should be used to centrally collect and store error logs from multiple network devices for troubleshooting?'
Why candidates choose this
Candidates may confuse syslog with monitoring tools because it aggregates data from devices, but they overlook that it doesn't provide traffic flow or bandwidth usage details.
✗SNMP trapWrong answer — click to see why▾
Why this is wrong here
SNMP traps are unsolicited notifications from network devices about events (e.g., link down), not a tool for continuous traffic monitoring or bandwidth usage analysis per host.
★ When this WOULD be the correct answer
A network administrator needs to receive real-time alerts when a specific interface exceeds a bandwidth threshold. SNMP traps would be configured to send notifications upon threshold violation, making them the best choice for event-driven bandwidth alerting.
Why candidates choose this
Candidates may confuse SNMP traps with SNMP polling for traffic statistics, or think traps provide ongoing traffic data, but traps only report specific events, not continuous bandwidth consumption.
✗TracerouteWrong answer — click to see why▾
Why this is wrong here
Traceroute is used to map the path packets take to a destination and measure hop-by-hop latency, not to monitor bandwidth consumption per host.
★ When this WOULD be the correct answer
A question asking 'Which tool can be used to identify the path and measure latency between a source and destination across a network?' would make traceroute the correct answer.
Why candidates choose this
Candidates may confuse traceroute's ability to show network paths and delays with bandwidth monitoring, assuming it can identify bandwidth hogs by showing where delays occur.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Network Documentation and Diagrams
Key term
Interface
An interface is a point of connection or interaction between two systems, devices, or software components that allows them to exchange information or signals.
Key term
Bandwidth
Bandwidth is the maximum amount of data that can travel over a network connection in a given amount of time, usually measured in bits per second.
About these practice questions
One of 464 original N10-009 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.