Exam 350-701 topic 1 question 108 discussion

A is the answer. While events can be delayed they are not delayed by default. The flow-create event is exported as soon as the flow is created if the flow-export delay flow-create command is not configured.

Delays the export of flow-create events.

A since NFSEL one of the most distinguished characteristics its to send data to multiple collectors simultaneously

A is correct

I think A is most accurate

The option D's wording implies that flow-create events are always delayed and this default action is a feature. However, flow-create events are actually optional and it is exactly this optionality makes it a feature. https://www.cisco.com/c/en/us/td/docs/security/asa/asa91/configuration/general/asa_91_general_config/monitor_nsel.html

Whew this is a hard question. Is A because as previously mentioned, delaying the export of flow-create events is NOT a default action. A is the "more correct" answer. Cisco exams are a racket.

Question translates to : "What is a feature [only] of Cisco NSEL ?" > A , its true for all Netflow implementations : IOS/IOS-XR/IOS-XE etc > B,C are wrong D is true and exists only on ASA's NSEL. So is the correct answer (even if delay is optional). ref: https://www.cisco.com/c/en/us/td/docs/security/asa/asa91/configuration/general/asa_91_general_config/monitor_nsel.html

Multiple references to the correct information "Delays the export of flow-create events"

D. https://www.cisco.com/c/en/us/td/docs/security/asa/asa91/asdm71/general/asdm_71_general_config/monitor_nsel.pdf Ref: page 2

https://www.cisco.com/c/en/us/td/docs/security/asa/asa91/asdm71/general/asdm_71_general_config/monitor_nsel.html#:~:text=Delays%20the%20export%20of%20flow%2Dcreate%20events

Some guys already pointed out the main point in the link "https://www.cisco.com/c/en/us/td/docs/security/asa/asa91/asdm71/general/asdm_71_general_config/monitor_nsel.pdf" The ASA and ASASM implementations of NSEL provide the following major functions: - Delays the export of flow-create events I don't see any related keyword "Multiple" for Netflow in the document.

D could be

Answer is A. Based on the link -https://www.cisco.com/c/en/us/td/docs/security/asa/asa91/asdm71/general/asdm_71_general_config/monitor_nsel.pdf. What is delayed is the export not the flow-create.

A is the correct answer

Feature History for NSEL - NetFlow Filtering 8.1(2) You can filter NetFlow events based on traffic and event type, then send records to different collectors. For example, you can log all flow-create events to one collector, and log flow-denied events to a different collector. https://www.cisco.com/c/en/us/td/docs/security/asa/asa91/asdm71/general/asdm_71_general_config/monitor_nsel.pdf

I think. The correct answer is D because "OPTIONAL: Configure a delay for flow-create NSEL events in seconds. Increasing flow-create delay will cause fewer NSEL events to be exported to NetVizura NetFlow collector. E.g. setting delay to 120 will cause only one NSEL event to be exported, for flows shorter than 2 minutes." https://confluence.netvizura.com/display/NVUG/Configuring+Cisco+ASAs+for+NSEL+Export