Question 520
A router exports ordinary interface SNMP counters, but operations needs per-source/destination five-tuple traffic statistics for a WAN link. The incident evidence is: A collector displays byte totals but no per-application flow records from the router. Which targeted configuration or design change best addresses the failure?
- Configure a supported Flexible NetFlow record, exporter and monitor on the appropriate interface and direction.
- Ensure the supported exporter sends compatible IPFIX/NetFlow templates at a suitable refresh interval.
- Account for sampling in interpretation and use unsampled collection where exact counts are required and supported.
- Attach the correct flow monitor to the intended ingress or egress direction supported by the platform.
Explanation
Correct Answer
A:The required correction is: Configure a supported Flexible NetFlow record, exporter and monitor on the appropriate interface and direction. The underlying failure mechanism is: Flexible NetFlow records or monitor attachment are not collecting the required per-flow keys. Verify success by carrying out this direct test: inspect NetFlow monitor cache and confirm collector receives expected five-tuple flow fields.
Incorrect Answers
B:Ensuring the supported exporter sends compatible IPFIX/NetFlow templates at a suitable refresh interval would not configure a supported Flexible NetFlow record, exporter and monitor on the appropriate interface and direction.
C:Account for sampling in interpretation and use unsampled collection where exact counts are required and supported would not configure a supported Flexible NetFlow record, exporter and monitor on the appropriate interface and direction.
D:Attaching the correct flow monitor to the intended ingress or egress direction supported by the platform would not configure a supported Flexible NetFlow record, exporter and monitor on the appropriate interface and direction.
Question 521
A router exports ordinary interface SNMP counters, but operations needs per-source/destination five-tuple traffic statistics for a WAN link. The proposed remedy is: Configure a supported Flexible NetFlow record, exporter and monitor on the appropriate interface and direction. Which observation would most directly confirm that remedy works as intended?
- Observe flow cache counters for traffic in the actual direction and match collector records.
- Inspect NetFlow monitor cache and confirm collector receives expected five-tuple flow fields.
- Compare sampled estimate versus actual traffic generator packet count on known flows.
- Check collector template receipt and verify fields decode correctly for sample flows.
Explanation
Correct Answer
B:The decisive acceptance observation is: Inspect NetFlow monitor cache and confirm collector receives expected five-tuple flow fields. This tests the working mechanism, while the original incident was: a collector displays byte totals but no per-application flow records from the router.
Incorrect Answers
A:This test measures a different behavior: Observe flow cache counters for traffic in the actual direction and match collector records. It does not establish the target outcome. For the documented fault, the direct acceptance test is: inspect NetFlow monitor cache and confirm collector receives expected five-tuple flow fields.
C:This test measures a different behavior: Compare sampled estimate versus actual traffic generator packet count on known flows. It does not establish the target outcome. For the documented fault, the direct acceptance test is: inspect NetFlow monitor cache and confirm collector receives expected five-tuple flow fields.
D:This test measures a different behavior: Check collector template receipt and verify fields decode correctly for sample flows. It does not establish the target outcome. For the documented fault, the direct acceptance test is: inspect NetFlow monitor cache and confirm collector receives expected five-tuple flow fields.
Question 522
A router exports ordinary interface SNMP counters, but operations needs per-source/destination five-tuple traffic statistics for a WAN link. During troubleshooting: A collector displays byte totals but no per-application flow records from the router. Which underlying cause best explains the recorded behavior?
- The collector lacks valid compatible templates or has mismatched export protocol expectations.
- Flexible NetFlow records or monitor attachment are not collecting the required per-flow keys.
- Packet sampling is probabilistic and does not guarantee observation of each short-lived flow.
- The monitor is attached in the wrong traffic direction/interface for the tested flows.
Explanation
Correct Answer
B:The actual technical cause is: Flexible NetFlow records or monitor attachment are not collecting the required per-flow keys. It specifically explains the observation: a collector displays byte totals but no per-application flow records from the router. The correcting configuration is: configure a supported Flexible NetFlow record, exporter and monitor on the appropriate interface and direction.
Incorrect Answers
A:That diagnosis is supported by a different symptom: Raw datagrams arrive at the collector but display as undecodable unknown fields. Here the recorded observation is: a collector displays byte totals but no per-application flow records from the router. The applicable cause is: flexible NetFlow records or monitor attachment are not collecting the required per-flow keys.
C:That diagnosis is supported by a different symptom: Short low-volume sessions disappear from sampled flow statistics. Here the recorded observation is: a collector displays byte totals but no per-application flow records from the router. The applicable cause is: flexible NetFlow records or monitor attachment are not collecting the required per-flow keys.
D:That diagnosis is supported by a different symptom: Telemetry remains empty during an outbound-only test despite healthy exporter sessions. Here the recorded observation is: a collector displays byte totals but no per-application flow records from the router. The applicable cause is: flexible NetFlow records or monitor attachment are not collecting the required per-flow keys.
Question 523
A router exports ordinary interface SNMP counters, but operations needs per-source/destination five-tuple traffic statistics for a WAN link. The initial change is: Configure a supported Flexible NetFlow record, exporter and monitor on the appropriate interface and direction. Which continuing control most directly prevents a recurrence of the documented problem: A collector displays byte totals but no per-application flow records from the router.
- Label sampled flow reports and avoid using sampled counts as exact billing records.
- Verify exporter connectivity, sampling and record templates after device upgrades.
- Document monitor attachment per physical/logical interface and intended observation direction.
- Monitor template refresh and collector decoding after record changes.
Explanation
Correct Answer
B:The continuing protective control is: Verify exporter connectivity, sampling and record templates after device upgrades. This addresses the underlying failure mechanism: flexible NetFlow records or monitor attachment are not collecting the required per-flow keys. The corresponding operational check is: inspect NetFlow monitor cache and confirm collector receives expected five-tuple flow fields.
Incorrect Answers
A:That control reduces a separate risk: Packet sampling is probabilistic and does not guarantee observation of each short-lived flow. For the described design, the recurring risk arises from: flexible NetFlow records or monitor attachment are not collecting the required per-flow keys. The specific required safeguard is: verify exporter connectivity, sampling and record templates after device upgrades.
C:That control reduces a separate risk: The monitor is attached in the wrong traffic direction/interface for the tested flows. For the described design, the recurring risk arises from: flexible NetFlow records or monitor attachment are not collecting the required per-flow keys. The specific required safeguard is: verify exporter connectivity, sampling and record templates after device upgrades.
D:That control reduces a separate risk: The collector lacks valid compatible templates or has mismatched export protocol expectations. For the described design, the recurring risk arises from: flexible NetFlow records or monitor attachment are not collecting the required per-flow keys. The specific required safeguard is: verify exporter connectivity, sampling and record templates after device upgrades.
Question 524
Flexible NetFlow configuration exists, but zero flows are seen because the monitor was applied only inbound while the test traffic is egress-only on that interface. The incident evidence is: Telemetry remains empty during an outbound-only test despite healthy exporter sessions. Which targeted configuration or design change best addresses the failure?
- Use a supported IPSLA UDP-jitter operation when the platform supports the intended test to measure jitter/packet loss.
- Attach the correct flow monitor to the intended ingress or egress direction supported by the platform.
- Account for sampling in interpretation and use unsampled collection where exact counts are required and supported.
- Configure a supported Flexible NetFlow record, exporter and monitor on the appropriate interface and direction.
Explanation
Correct Answer
B:The required correction is: Attach the correct flow monitor to the intended ingress or egress direction supported by the platform. The underlying failure mechanism is: The monitor is attached in the wrong traffic direction/interface for the tested flows. Verify success by carrying out this direct test: observe flow cache counters for traffic in the actual direction and match collector records.
Incorrect Answers
A:Using a supported IPSLA UDP-jitter operation when the platform supports the intended test to measure jitter/packet loss would not attach the correct flow monitor to the intended ingress or egress direction supported by the platform.
C:Account for sampling in interpretation and use unsampled collection where exact counts are required and supported would not attach the correct flow monitor to the intended ingress or egress direction supported by the platform.
D:Configuring a supported Flexible NetFlow record, exporter and monitoring on the appropriate interface and direction would not attach the correct flow monitor to the intended ingress or egress direction supported by the platform.
Question 525
Flexible NetFlow configuration exists, but zero flows are seen because the monitor was applied only inbound while the test traffic is egress-only on that interface. The proposed remedy is: Attach the correct flow monitor to the intended ingress or egress direction supported by the platform. Which observation would most directly confirm that remedy works as intended?
- Observe flow cache counters for traffic in the actual direction and match collector records.
- Compare UDP-jitter output under controlled impaired links against basic ICMP RTT.
- Compare sampled estimate versus actual traffic generator packet count on known flows.
- Inspect NetFlow monitor cache and confirm collector receives expected five-tuple flow fields.
Explanation
Correct Answer
A:The decisive acceptance observation is: Observe flow cache counters for traffic in the actual direction and match collector records. This tests the working mechanism, while the original incident was: telemetry remains empty during an outbound-only test despite healthy exporter sessions.
Incorrect Answers
B:This test measures a different behavior: Compare UDP-jitter output under controlled impaired links against basic ICMP RTT. It does not establish the target outcome. For the documented fault, the direct acceptance test is: observe flow cache counters for traffic in the actual direction and match collector records.
C:This test measures a different behavior: Compare sampled estimate versus actual traffic generator packet count on known flows. It does not establish the target outcome. For the documented fault, the direct acceptance test is: observe flow cache counters for traffic in the actual direction and match collector records.
D:This test measures a different behavior: Inspect NetFlow monitor cache and confirm collector receives expected five-tuple flow fields. It does not establish the target outcome. For the documented fault, the direct acceptance test is: observe flow cache counters for traffic in the actual direction and match collector records.
Question 526
Flexible NetFlow configuration exists, but zero flows are seen because the monitor was applied only inbound while the test traffic is egress-only on that interface. During troubleshooting: Telemetry remains empty during an outbound-only test despite healthy exporter sessions. Which underlying cause best explains the recorded behavior?
- Basic ICMP RTT does not measure the interpacket-delay variation and loss affecting voice quality.
- Packet sampling is probabilistic and does not guarantee observation of each short-lived flow.
- The monitor is attached in the wrong traffic direction/interface for the tested flows.
- Flexible NetFlow records or monitor attachment are not collecting the required per-flow keys.
Explanation
Correct Answer
C:The actual technical cause is: The monitor is attached in the wrong traffic direction/interface for the tested flows. It specifically explains the observation: telemetry remains empty during an outbound-only test despite healthy exporter sessions. The correcting configuration is: attach the correct flow monitor to the intended ingress or egress direction supported by the platform.
Incorrect Answers
A:That diagnosis is supported by a different symptom: Voice breaks up while ICMP round-trip latency remains acceptable. Here the recorded observation is: telemetry remains empty during an outbound-only test despite healthy exporter sessions. The applicable cause is: the monitor is attached in the wrong traffic direction/interface for the tested flows.
B:That diagnosis is supported by a different symptom: Short low-volume sessions disappear from sampled flow statistics. Here the recorded observation is: telemetry remains empty during an outbound-only test despite healthy exporter sessions. The applicable cause is: the monitor is attached in the wrong traffic direction/interface for the tested flows.
D:That diagnosis is supported by a different symptom: A collector displays byte totals but no per-application flow records from the router. Here the recorded observation is: telemetry remains empty during an outbound-only test despite healthy exporter sessions. The applicable cause is: the monitor is attached in the wrong traffic direction/interface for the tested flows.
Question 527
Flexible NetFlow configuration exists, but zero flows are seen because the monitor was applied only inbound while the test traffic is egress-only on that interface. The initial change is: Attach the correct flow monitor to the intended ingress or egress direction supported by the platform. Which continuing control most directly prevents a recurrence of the documented problem: Telemetry remains empty during an outbound-only test despite healthy exporter sessions.
- Label sampled flow reports and avoid using sampled counts as exact billing records.
- Document monitor attachment per physical/logical interface and intended observation direction.
- Track UDP-specific jitter and packet-loss thresholds separately from generic ping availability.
- Verify exporter connectivity, sampling and record templates after device upgrades.
Explanation
Correct Answer
B:The continuing protective control is: Document monitor attachment per physical/logical interface and intended observation direction. This addresses the underlying failure mechanism: the monitor is attached in the wrong traffic direction/interface for the tested flows. The corresponding operational check is: observe flow cache counters for traffic in the actual direction and match collector records.
Incorrect Answers
A:That control reduces a separate risk: Packet sampling is probabilistic and does not guarantee observation of each short-lived flow. For the described design, the recurring risk arises from: the monitor is attached in the wrong traffic direction/interface for the tested flows. The specific required safeguard is: document monitor attachment per physical/logical interface and intended observation direction.
C:That control reduces a separate risk: Basic ICMP RTT does not measure the interpacket-delay variation and loss affecting voice quality. For the described design, the recurring risk arises from: the monitor is attached in the wrong traffic direction/interface for the tested flows. The specific required safeguard is: document monitor attachment per physical/logical interface and intended observation direction.
D:That control reduces a separate risk: Flexible NetFlow records or monitor attachment are not collecting the required per-flow keys. For the described design, the recurring risk arises from: the monitor is attached in the wrong traffic direction/interface for the tested flows. The specific required safeguard is: document monitor attachment per physical/logical interface and intended observation direction.
Question 528
The NetFlow exporter reaches a collector by IP, yet the collector cannot parse flows because template records are missing. The incident evidence is: Raw datagrams arrive at the collector but display as undecodable unknown fields. Which targeted configuration or design change best addresses the failure?
- Attach the correct flow monitor to the intended ingress or egress direction supported by the platform.
- Configure a supported Flexible NetFlow record, exporter and monitor on the appropriate interface and direction.
- Ensure the supported exporter sends compatible IPFIX/NetFlow templates at a suitable refresh interval.
- Use supported ERSPAN encapsulation from source to routed collector destination with reachable outer IP paths.
Explanation
Correct Answer
C:The required correction is: Ensure the supported exporter sends compatible IPFIX/NetFlow templates at a suitable refresh interval. The underlying failure mechanism is: The collector lacks valid compatible templates or has mismatched export protocol expectations. Verify success by carrying out this direct test: check collector template receipt and verify fields decode correctly for sample flows.
Incorrect Answers
A:Attaching the correct flow monitor to the intended ingress or egress direction supported by the platform would not ensure the supported exporter sends compatible IPFIX/NetFlow templates at a suitable refresh interval.
B:Configuring a supported Flexible NetFlow record, exporter and monitoring on the appropriate interface and direction would not ensure the supported exporter sends compatible IPFIX/NetFlow templates at a suitable refresh interval.
D:Using supported ERSPAN encapsulation from source to routed collector destination with reachable outer IP paths would not ensure the supported exporter sends compatible IPFIX/NetFlow templates at a suitable refresh interval.
Question 529
The NetFlow exporter reaches a collector by IP, yet the collector cannot parse flows because template records are missing. The proposed remedy is: Ensure the supported exporter sends compatible IPFIX/NetFlow templates at a suitable refresh interval. Which observation would most directly confirm that remedy works as intended?
- Inspect NetFlow monitor cache and confirm collector receives expected five-tuple flow fields.
- Inspect ERSPAN GRE packets at the collector and verify the correct session ID and payload.
- Observe flow cache counters for traffic in the actual direction and match collector records.
- Check collector template receipt and verify fields decode correctly for sample flows.
Explanation
Correct Answer
D:The decisive acceptance observation is: Check collector template receipt and verify fields decode correctly for sample flows. This tests the working mechanism, while the original incident was: raw datagrams arrive at the collector but display as undecodable unknown fields.
Incorrect Answers
A:This test measures a different behavior: Inspect NetFlow monitor cache and confirm collector receives expected five-tuple flow fields. It does not establish the target outcome. For the documented fault, the direct acceptance test is: check collector template receipt and verify fields decode correctly for sample flows.
B:This test measures a different behavior: Inspect ERSPAN GRE packets at the collector and verify the correct session ID and payload. It does not establish the target outcome. For the documented fault, the direct acceptance test is: check collector template receipt and verify fields decode correctly for sample flows.
C:This test measures a different behavior: Observe flow cache counters for traffic in the actual direction and match collector records. It does not establish the target outcome. For the documented fault, the direct acceptance test is: check collector template receipt and verify fields decode correctly for sample flows.
Question 530
The NetFlow exporter reaches a collector by IP, yet the collector cannot parse flows because template records are missing. During troubleshooting: Raw datagrams arrive at the collector but display as undecodable unknown fields. Which underlying cause best explains the recorded behavior?
- The collector lacks valid compatible templates or has mismatched export protocol expectations.
- Flexible NetFlow records or monitor attachment are not collecting the required per-flow keys.
- The implementation uses a Layer 2 RSPAN assumption across a network lacking VLAN continuity.
- The monitor is attached in the wrong traffic direction/interface for the tested flows.
Explanation
Correct Answer
A:The actual technical cause is: The collector lacks valid compatible templates or has mismatched export protocol expectations. It specifically explains the observation: raw datagrams arrive at the collector but display as undecodable unknown fields. The correcting configuration is: ensure the supported exporter sends compatible IPFIX/NetFlow templates at a suitable refresh interval.
Incorrect Answers
B:That diagnosis is supported by a different symptom: A collector displays byte totals but no per-application flow records from the router. Here the recorded observation is: raw datagrams arrive at the collector but display as undecodable unknown fields. The applicable cause is: the collector lacks valid compatible templates or has mismatched export protocol expectations.
C:That diagnosis is supported by a different symptom: Traffic capture fails across a routed hop even though the source port sees packets. Here the recorded observation is: raw datagrams arrive at the collector but display as undecodable unknown fields. The applicable cause is: the collector lacks valid compatible templates or has mismatched export protocol expectations.
D:That diagnosis is supported by a different symptom: Telemetry remains empty during an outbound-only test despite healthy exporter sessions. Here the recorded observation is: raw datagrams arrive at the collector but display as undecodable unknown fields. The applicable cause is: the collector lacks valid compatible templates or has mismatched export protocol expectations.
Implementing Cisco Enterprise Network Core Technologies (ENCOR) (350-401) Practice Tests