Exam 350-501 topic 1 question 11 discussion

I think it would be A, i believe this is referring to the netflow template format which has a field for source interface. Not to be confused with the output from "show ip cache flow" on a device.

So I would suppose that "information provided for traceback analysis" means netflow export data, not the output of the "show ip cache flow" (wich is a traceback analysis of the raw netflow data that the router itself generates). Is this right ? Packet size distribution and IP sub flow cache are visible in the show ip cache flow output, generated by the router, based on netflow data and they should not be part of the netflow export data. BGP version is not used in netflow export, but source interface it is. I would go with answer A

The IP sub flow cache is a feature in Cisco IOS that allows you to store additional information about IP flows. The IP sub flow cache is a separate cache from the main NetFlow cache. This means that the IP sub flow cache can store information about flows that are not being exported using NetFlow. The IP sub flow cache can be enabled on a per-interface basis. To enable the IP sub flow cache on an interface, you can use the following command: ip flow-cache sub on

I'm voting for A based on this paragraph from Cisco. It specifically talks about tracing the source of an attack and using NetFlow to know the source interface. Keywords are in all caps. "The originator of DoS attacks cannot be easily identified because the IP source address of the device sending the traffic is usually forged. However, you can easily TRACE the traffic BACK through the network to the router on which it is arriving by using the NetFlow Layer 2 and Security Monitoring Exports feature to capture the MAC address and VLAN-ID fields. If the router on which traffic is arriving supports NetFlow, you can configure the NetFlow Layer 2 and Security Monitoring Exports feature on it to identify the INTERFACE on which the traffic is ARRIVING." https://www.cisco.com/en/US/docs/ios-xml/ios/netflow/configuration/15-2s/nf-detct-analy-thrts.html

The whole purpose of Netflow is to provide information about data flows, so correct answer would be “C”. The other answers have no sense.

A is the correct answer

The "ip route-cache flow" can be used only under the main interface, while the "ip flow ingress" was an enhancement to be used under subinterfaces.

Based on the following link https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/netflow/configuration/15-mt/nf-15-mt-book/get-start-cfg-nflow.html. I would the answer should be C

I think it C is correct because of A,B,D are not applicable for the question.