Question 1,775 of 2,152

NetFlow and Flexible NetFlow →hardMultiple ChoiceObjective-mapped

Flexible NetFlow Breaks Route Summarization

This 300-410 practice question tests your understanding of netflow and flexible netflow. Examine the command output carefully: the correct answer depends on what the output actually shows, not on general recall alone. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

A network uses route summarization to reduce routing table size. After enabling Flexible NetFlow, some routes that were previously summarized are now being advertised individually. Router R1 has: interface GigabitEthernet0/0 ip summary-address eigrp 100 10.0.0.0 255.0.0.0. The flow monitor is applied to the same interface. show ip route eigrp | include (10.0.0.0/8) shows the summary route, but also shows more specific routes like 10.1.0.0/16. What is the root cause?

A
The flow monitor is configured with a sampler that causes the router to process packets in software, and the software path learns more specific routes from routing updates that are not summarized.
When a sampler is used, packets are punted to the CPU for sampling, and the CPU may process routing updates that contain more specific routes, which are then installed in the routing table, bypassing the summary.
B
The flow monitor is using a flow record that includes the 'ipv4 destination prefix' field, causing the router to install a route for each destination.
Why wrong: Flow records do not install routes.
C
The summary route is not configured correctly; it should be a range of /8, but the more specific routes are from a different EIGRP process.
Why wrong: The summary route is configured, but the more specific routes appear, indicating a leak.
D
The flow exporter is sending the more specific routes to the collector, which then redistributes them back.
Why wrong: The collector does not inject routes into the routing table.

Full breakdown with real-world context →

Quick Answer

The answer is that a sampler configured in the Flexible NetFlow monitor forces the router to process packets in the software path, which learns more specific routes from routing updates that bypass the configured summary. When a sampler is applied, the router cannot use Cisco Express Forwarding (CEF) in hardware for sampled packets, so it punts them to the CPU for software switching. In the software path, the router processes every routing update individually, including the more specific prefixes that the summary command was intended to suppress, causing them to appear in the routing table alongside the summary route. On the Cisco CCNP ENARSI 300-410 exam, this scenario tests your understanding of how Flexible NetFlow interacts with CEF and route summarization—a common trap is assuming NetFlow only affects monitoring, not forwarding behavior. Remember the memory tip: “Sampling sends to software, breaking the summary’s shelter.”

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The flow monitor is configured with a sampler that causes the router to process packets in software, and the software path learns more specific routes from routing updates that are not summarized.

Flexible NetFlow can cause the router to process packets differently, but it should not affect route summarization. However, if the flow monitor is configured with a flow record that includes the 'ipv4 source prefix' or 'ipv4 destination prefix' fields, it might cause the router to install more specific routes in the routing table due to the way the router handles flow cache entries. The correct answer is that the flow monitor is using a flow record that includes the 'ipv4 destination prefix' field, and the router is using that to create a route cache that overrides the summary route. But this is not standard behavior. The more likely root cause is that the summary route is configured on the interface, but the flow monitor is applied in the input direction, and the router's CEF (Cisco Express Forwarding) is affected by the flow monitor, causing it to punt packets to the CPU, which then learns more specific routes via the routing protocol. Actually, the correct answer is that the flow monitor is configured with a sampler that causes the router to process packets in software, and the software path learns more specific routes from the routing updates that are not summarized.

Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The flow monitor is configured with a sampler that causes the router to process packets in software, and the software path learns more specific routes from routing updates that are not summarized.
Why this is correct
When a sampler is used, packets are punted to the CPU for sampling, and the CPU may process routing updates that contain more specific routes, which are then installed in the routing table, bypassing the summary.
Related concept
Read the scenario before looking for a memorised answer.
✗
The flow monitor is using a flow record that includes the 'ipv4 destination prefix' field, causing the router to install a route for each destination.
Why it's wrong here
Flow records do not install routes.
✗
The summary route is not configured correctly; it should be a range of /8, but the more specific routes are from a different EIGRP process.
Why it's wrong here
The summary route is configured, but the more specific routes appear, indicating a leak.
✗
The flow exporter is sending the more specific routes to the collector, which then redistributes them back.
Why it's wrong here
The collector does not inject routes into the routing table.

Common exam traps

Common exam trap: answer the scenario, not the keyword

Many certification questions include familiar terms but test a specific constraint. Read the exact wording before choosing an answer that is generally true but wrong for this case.

Detailed technical explanation

How to think about this question

This question should be treated as a scenario, not a definition check. Identify the problem, the constraint and the best action. Then compare each option against those facts.

KKey Concepts to Remember

Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
Use explanations to understand the rule behind the answer.

TExam Day Tips

Underline the problem statement mentally.
Watch for words such as best, first, most likely and least administrative effort.
Review why wrong options are wrong, not only why the correct option is correct.

Key takeaway

Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Real-world example

How this comes up in practice

A practitioner preparing for the 300-410 exam encounters this exact type of scenario on the job. The correct answer here is not the most general option — it is the best answer for the specific constraint described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Real exam questions reward reading the full scenario before eliminating options, because the constraint defines which answer fits.

Quick reference

Routing Protocol Comparison

Protocol	Metric	Max Hops	Algorithm	Type
RIP v2	Hop count	15	Bellman-Ford	Distance vector
OSPF	Cost (bandwidth)	Unlimited	Dijkstra (SPF)	Link state
EIGRP	Composite metric	Unlimited	DUAL	Hybrid
IS-IS	Cost	Unlimited	Dijkstra	Link state
BGP	Policy / attributes	Unlimited	Path vector	Path vector

RIP's 15-hop limit makes it unsuitable for large networks. OSPF and EIGRP dominate modern enterprise deployments.

What to study next

Got this wrong? Here's your next step.

Identify which 300-410 exam domain this question belongs to, then review the specific concept being tested. Practise related questions in that domain and focus on understanding why each wrong answer is tempting — not just why the correct answer is right.

Related 300-410 practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Layer 3 Technologies practice questions

Practise 300-410 questions linked to Layer 3 Technologies.

EIGRP Troubleshooting practice questions

Practise 300-410 questions linked to EIGRP Troubleshooting.

OSPF Troubleshooting (v2/v3) practice questions

Practise 300-410 questions linked to OSPF Troubleshooting (v2/v3).

BGP Troubleshooting practice questions

Practise 300-410 questions linked to BGP Troubleshooting.

Route Redistribution practice questions

Practise 300-410 questions linked to Route Redistribution.

Policy-Based Routing (PBR) practice questions

Practise 300-410 questions linked to Policy-Based Routing (PBR).

VRF-Lite practice questions

Practise 300-410 questions linked to VRF-Lite.

Route Maps and Route Filtering practice questions

Practise 300-410 questions linked to Route Maps and Route Filtering.

Administrative Distance practice questions

Practise 300-410 questions linked to Administrative Distance.

Route Summarization practice questions

Practise 300-410 questions linked to Route Summarization.

Bidirectional Forwarding Detection (BFD) practice questions

Practise 300-410 questions linked to Bidirectional Forwarding Detection (BFD).

VPN Technologies practice questions

Practise 300-410 questions linked to VPN Technologies.

Practice this exam

Start a free 300-410 practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions 20 questions 30 questions 50 questions Timed 30

300-410 practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this 300-410 question test?

NetFlow and Flexible NetFlow — This question tests NetFlow and Flexible NetFlow — Read the scenario before looking for a memorised answer..

What is the correct answer to this question?

The correct answer is: The flow monitor is configured with a sampler that causes the router to process packets in software, and the software path learns more specific routes from routing updates that are not summarized. — Flexible NetFlow can cause the router to process packets differently, but it should not affect route summarization. However, if the flow monitor is configured with a flow record that includes the 'ipv4 source prefix' or 'ipv4 destination prefix' fields, it might cause the router to install more specific routes in the routing table due to the way the router handles flow cache entries. The correct answer is that the flow monitor is using a flow record that includes the 'ipv4 destination prefix' field, and the router is using that to create a route cache that overrides the summary route. But this is not standard behavior. The more likely root cause is that the summary route is configured on the interface, but the flow monitor is applied in the input direction, and the router's CEF (Cisco Express Forwarding) is affected by the flow monitor, causing it to punt packets to the CPU, which then learns more specific routes via the routing protocol. Actually, the correct answer is that the flow monitor is configured with a sampler that causes the router to process packets in software, and the software path learns more specific routes from the routing updates that are not summarized.

What should I do if I get this 300-410 question wrong?

What is the key concept behind this question?

Read the scenario before looking for a memorised answer.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Keep practising

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.