NetFlow, IP SLA & Object Tracking Practice Questions

Answers and explanations appear when you work through the set above.

1. Which IP SLA operation type is the simplest choice for confirming basic reachability and measuring round-trip time to a remote host?

   • UDP jitter
   • ICMP echo
   • HTTP
   • DNS

2. Which IP SLA metric matters most when validating a path intended to carry voice traffic?

   • Jitter (variation in inter-packet arrival delay)
   • TTL decrement count
   • MTU along the path
   • Number of AS hops in the BGP path

3. An ICMP echo IP SLA operation always shows as down even though the router itself can ping the target successfully with the default source address. The operation explicitly sets a source interface. What is the most likely cause?

   • The IP SLA operation ID conflicts with another operation
   • The configured source address or VRF does not have a valid outbound and return path to the target
   • IP SLA requires a loopback interface as the source
   • The target device does not support IP SLA

4. Which command displays the recent success/failure history, round-trip time, and return code for a configured IP SLA operation?

   • show ip sla statistics
   • show ip sla configuration
   • show track
   • show flow monitor

5. On the remote router acting as the target for IP SLA probes, which command confirms the control port and the count of received/errored probes handled by the responder process?

   • show ip sla responder
   • show ip sla statistics
   • show ip sla application
   • show track brief

6. Which command traces the real-time behavior of one specific IP SLA operation, useful when isolating why a single probe is failing?

   • debug ip sla trace <operation-id>
   • debug ip icmp
   • debug ip routing
   • debug track events

7. debug ip sla trace repeatedly reports 'Timeout' for a configured source/destination pair. What does that output actually prove?

   • The router's CPU is overloaded and dropping the debug feed
   • The probe left the router but no response arrived within the configured timeout, pointing to a forward-path, return-path, or filtering problem
   • The IP SLA schedule has not started yet
   • The destination has rate-limited SNMP polling

8. What functional role does an object-tracking configuration provide to other features on a Cisco IOS device?

   • It builds a dynamic Up or Down state, derived from an interface, a route's presence, an IP SLA result, or a boolean combination of other tracked objects, that other features can react to
   • It encrypts control-plane traffic between routing peers
   • It compresses NetFlow export records before they leave the device
   • It replaces the routing protocol's metric calculation

9. A static route is configured to reference a track object. What happens to that static route the moment the tracked object transitions to Down?

   • Nothing changes until the next routing protocol convergence cycle
   • The route is withdrawn from the RIB and stops being a candidate for forwarding
   • The route's administrative distance is automatically lowered
   • The route is converted into a floating static route with a higher metric

10. How does a tracking object typically influence a first-hop redundancy protocol such as HSRP or VRRP?

    • It forces an immediate re-election regardless of priority
    • It adjusts the local router's priority up or down based on the tracked object's state, which can shift active/standby roles
    • It changes the virtual IP address assigned to the group
    • It disables preemption on the group permanently

11. Which command confirms how a track object is configured and what its current Up/Down state is?

    • show track
    • show ip sla statistics
    • show standby brief
    • show ip route track-table

12. An IP SLA probe is confirmed to be failing, but the static route it should be protecting stays installed in the RIB regardless. What should be checked first?

    • Whether the SLA operation ID actually matches the operation referenced by the track object, and whether the static route itself references that track object
    • Whether BFD timers are set too aggressively
    • Whether the route's administrative distance was manually lowered below the connected route
    • Whether NetFlow is exporting flow records for that destination

13. The next-hop router on a WAN link stays reachable and its interface never goes down, but the actual service reachable through that next hop has failed. Which design lets a router still remove the primary route in this scenario?

    • Track only the local interface line-protocol state
    • Track an IP SLA operation aimed at a meaningful remote target beyond the next hop, rather than tracking interface state alone
    • Increase the static route's administrative distance
    • Disable CDP on the WAN interface

14. An IP SLA operation's most recent return code shows OK and the running success counter keeps incrementing. What does this confirm?

    • The probe is currently succeeding and reaching its target as configured
    • The operation has been misconfigured with the wrong destination
    • The router is dropping packets due to a QoS policy
    • The tracked object linked to this operation is stuck in a Down state

15. At a high level, what does NetFlow (and its successor, Flexible NetFlow) primarily provide to a network operations team?

    • Encrypted transport for management sessions
    • Metadata and statistics describing the traffic flows observed traversing the device, useful for visibility and capacity/security analysis
    • A dynamic routing protocol for exchanging reachability information
    • Address resolution for NBMA next-hop mappings

16. Why is NetFlow version 9 described as a template-based export format, unlike the older fixed-format version 5?

    • It uses OSPF LSAs to distribute record layouts
    • The exporting device sends template records that describe the field layout, and subsequent data records are interpreted by the collector according to that template
    • It requires manually pre-loading templates on the router before any export can occur
    • Every record is compressed using a shared dictionary negotiated at export time

17. In Flexible NetFlow, which component is responsible for defining exactly which fields are used to key/match a flow and which fields are collected as data about it?

    • The flow exporter
    • The flow monitor
    • The flow record
    • The flow sampler

18. Which Flexible NetFlow component specifies the collector's destination address, transport protocol/port, and export version?

    • The flow record
    • The flow exporter
    • The flow monitor
    • The flow cache

19. Which Flexible NetFlow component ties together a flow record with a cache and, optionally, one or more flow exporters, and is the piece that actually gets applied to an interface?

    • The flow sampler
    • The flow record
    • The flow monitor
    • The flow topology

20. A flow monitor and record have been fully configured, but no traffic statistics ever populate the cache. What step was most likely skipped?

    • Applying the flow monitor to the relevant interface in the correct input or output direction
    • Configuring a flow sampler under the monitor
    • Setting the router's clock with NTP
    • Enabling CDP on the interface

21. Which command confirms whether a Flexible NetFlow monitor is actually enabled on a given interface and in which direction?

    • show flow interface
    • show flow record
    • show ip interface brief
    • show flow exporter statistics

22. Which command displays a flow monitor's associated record, exporter, cache type, and active/inactive timeout values in one place?

    • show flow monitor <name>
    • show flow exporter <name>
    • show flow record <name>
    • show ip flow top-talkers

23. Which command is used to confirm an exporter's destination address, export version, and transport details (protocol and port)?

    • show flow exporter <name>
    • show flow interface
    • show flow monitor cache
    • show flow record

24. What does the flow monitor's cache actually hold during normal operation?

    • A static list of every possible flow key combination configured on the device
    • The active flow entries and their accumulated statistics, until each entry ages out and is exported (or is exported and then cleared, depending on cache type)
    • A copy of the routing table used only for flow lookups
    • The SSH host key fingerprint used for encrypted export

25. What is the purpose of the flow cache active timeout on a Flexible NetFlow monitor?

    • It periodically ages out and exports long-lived flows even while matching traffic keeps arriving, so ongoing conversations are still reported at regular intervals
    • It deletes flow records that never received any matching traffic
    • It controls how often the exporter re-sends its template records
    • It sets the maximum number of concurrent flows the cache can hold

26. What is the purpose of the flow cache inactive timeout on a Flexible NetFlow monitor?

    • It exports and removes a flow entry after no matching traffic has been seen for the configured interval, freeing that cache slot
    • It forces a template resend to the collector after a period of exporter silence
    • It limits how long the router keeps an SSH session open for exported data
    • It resets the flow record's match field list periodically

27. What operational risk should be kept in mind when using a permanent (non-expiring) Flexible NetFlow cache?

    • It disables the ability to view any statistics until manually cleared
    • If the cache fills to capacity, new flows cannot be added until space is freed, so it needs to be sized and managed carefully
    • It automatically disables the flow exporter after 24 hours
    • It forces all flow records to switch to NetFlow version 5 format

28. show flow monitor cache confirms entries exist and are being updated, but the configured collector reports receiving nothing at all. What should be checked next?

    • The flow record's match field list
    • The exporter's destination address, export version, and UDP source/port, and whether that exporter is actually referenced by the flow monitor
    • The flow cache's active timeout value
    • The interface's MTU setting

29. A flow monitor is applied only in the input direction on an interface. Transit traffic that enters the router on another interface and leaves through this one is not appearing in the flow statistics. What is the likely explanation?

    • Transit traffic can never be captured by NetFlow regardless of direction
    • An input-only monitor does not see traffic that egresses the interface; the traffic of interest is only visible if the monitor is also applied in the output direction
    • The flow exporter must be reconfigured to use TCP instead of UDP
    • The flow record needs an additional match field for the input interface

30. What is the core value that Bidirectional Forwarding Detection (BFD) adds when paired with a routing protocol like OSPF, EIGRP, or BGP?

    • It provides fast, sub-second detection of forwarding-path failure that is independent of, and typically much quicker than, the routing protocol's own hello/dead timers
    • It encrypts routing protocol updates exchanged between neighbors
    • It replaces the need for a routing protocol entirely on point-to-point links
    • It automatically summarizes routes at area or AS boundaries

31. Does enabling BFD for a routing protocol change how that protocol calculates its best path or builds its topology database?

    • Yes, BFD takes over metric calculation once enabled
    • No, BFD only supplies rapid up/down liveness information to the routing protocol; the routing protocol still owns neighbor relationships and path/route computation
    • Yes, BFD replaces SPF and DUAL calculations with its own algorithm
    • No, but BFD does replace the need for routing protocol authentication

32. A point-to-point link's physical interface and line protocol both remain up, but the far-end device has actually stopped forwarding traffic correctly. Why is BFD useful in this scenario even though the interface itself never went down?

    • BFD can detect the forwarding-path failure independently of interface state, since it actively verifies liveness with the neighbor rather than relying only on Layer 1/2 status
    • BFD automatically shuts down the interface when it detects a problem
    • BFD reroutes traffic itself without involving the routing protocol
    • BFD only works when the interface has already gone down

33. What outcome is the primary design goal when BFD is deployed alongside a routing protocol on a critical link?

    • Reduced configuration complexity for ACLs on the link
    • Faster overall network convergence after a forwarding-path failure, by detecting the failure well before the routing protocol's own timers would
    • Automatic load balancing across equal-cost paths
    • Elimination of the need for routing protocol authentication

34. Is BFD primarily a mechanism for encrypting traffic between routers?

    • Yes, BFD establishes an IPsec tunnel between neighbors automatically
    • No, BFD is strictly a rapid failure-detection mechanism; it has nothing to do with encrypting data or control-plane traffic
    • Yes, BFD negotiates a shared key used to encrypt routing updates
    • No, but BFD does compress routing updates to speed convergence