N10-009 Question 208
Single answerFlow data, Packet capture, Baseline metricsA network administrator is troubleshooting reports that users experience slow performance every weekday between 9:00 a.m. and 10:00 a.m. on the WAN link to a branch office. The administrator has already collected baseline metrics for the link over the past month and knows normal utilization at that time is typically 35% with low packet loss. Today, monitoring shows the link jumps to 95% utilization during the slowdown. The administrator needs to quickly identify which hosts and applications are consuming the bandwidth without capturing full packet contents across the entire WAN. Which tool or approach should the administrator use FIRST?
- A
Review flow data from the router exporting NetFlow/IPFIX records for the WAN interface
- B
Run a full packet capture on every branch office endpoint to inspect payload contents
- C
Compare the WAN router's startup configuration to the running configuration
- D
Replace the WAN router because the baseline shows utilization is above normal
Show answer and explanation
Correct answer: A
Explanation
This question tests the practical distinction between baseline metrics, flow data, and packet capture. Baseline metrics establish normal conditions, such as expected utilization, latency, and packet loss, so anomalies can be recognized. In this case, the baseline confirms the WAN is operating well above normal during the slowdown window. The next best step is to use flow data, such as NetFlow or IPFIX, because it provides a scalable summary of who is talking, to whom, over which ports and protocols, and how much bandwidth is being used. That makes it ideal for identifying top talkers and high-volume applications on a congested WAN link. Packet capture remains valuable, but it is typically the follow-up tool when detailed inspection is needed after the problematic traffic has been narrowed down. This aligns with common vendor guidance and operational best practices: use baselines to detect anomalies, use flow telemetry to identify traffic patterns and bandwidth consumers, and use packet capture for deep analysis when necessary.
- A. Correct.
Correct. Flow data such as NetFlow or IPFIX is designed to summarize conversations by source/destination, ports, protocols, interfaces, and volume. In this scenario, the administrator already knows from baseline metrics that utilization is abnormally high and now needs to identify the top talkers and applications quickly without collecting full packet contents. Reviewing exported flow records from the WAN interface is the most efficient first step for determining what traffic is driving the spike.
- B. Incorrect.
Incorrect. Packet capture is useful when the administrator needs detailed frame and packet contents, flags, retransmissions, or application-layer payload analysis. However, the scenario specifically says the administrator wants to identify hosts and applications without capturing full packet contents across the WAN. Capturing from every endpoint would be operationally heavy, unnecessary as a first step, and less efficient than using flow telemetry to identify top bandwidth consumers.
- C. Incorrect.
Incorrect. Comparing startup and running configurations can help identify recent device configuration changes, but the problem described is bandwidth saturation during a predictable time window. The baseline metrics already indicate this is a traffic-volume issue, not necessarily a configuration drift issue. This option does not directly identify which systems or traffic types are consuming the link.
- D. Incorrect.
Incorrect. A baseline helps establish what normal performance looks like, so the administrator can recognize that 95% utilization is abnormal compared with the normal 35%. However, exceeding the baseline does not by itself prove the router is faulty. The correct next step is to investigate the traffic causing the spike rather than immediately replacing hardware.