A security operations center (SOC) needs to analyze traffic patterns across a high-speed backbone to detect volumetric anomalies. The team wants a flow-based monitoring solution that can be exported to an existing collector that only supports standard NetFlow v5. However, they also want to include application-level information in the future. What should the network engineer configure on the routers to meet the immediate requirement?

Configure IPFIX with a custom template that includes application ID fields.

Enable traditional NetFlow v5 export with a fixed 5-tuple flow record.

Set up NSEL on the routers to export security events instead of flow records.

Use SNMP to poll interface counters and calculate flow rates manually.

An administrator is configuring eStreamer on a Firepower Management Center (FMC) to send events to an external collector. The collector requires a secure connection and the administrator wants to ensure that events are not lost during a network interruption. What should the administrator configure?

Configure syslog as a backup to eStreamer.

Use a reliable transport protocol like TCP and configure buffering.

Set the eStreamer to use UDP for faster transmission.

Enable TLS on the eStreamer connection and configure a client certificate.

A large enterprise is migrating from a legacy NetFlow v5 collector to a new IPFIX-based system. The network has many routers and switches. The migration must be seamless, and the team wants to ensure that the new collector can receive both NetFlow v5 and IPFIX during the transition. What is the best approach?

Configure all devices to export IPFIX and disable NetFlow v5 immediately.

Switch to SNMP polling for flow data during the migration.

Use a protocol converter to translate NetFlow v5 to IPFIX.

Run both NetFlow v5 and IPFIX exports concurrently on all devices.

CCIE Security

Domain 3Objective 6

3.6 Monitoring Protocols CCIE-SECURITY Practice Questions (Page 5)

Part of the 3.0 Security Infrastructure domain, which accounts for 15% of the CCIE-SECURITY exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–1 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

11concepts

15%of the exam

Questions 21–25

21foundation · easy
Which SNMP version provides authentication and encryption?
Select an answer first
22foundation · easy
Which SNMP operation is used by a manager to change a value on a managed device?
Select an answer first
23application · medium
A security operations center (SOC) needs to analyze traffic patterns across a high-speed backbone to detect volumetric anomalies. The team wants a flow-based monitoring solution that can be exported to an existing collector that only supports standard NetFlow v5. However, they also want to include application-level information in the future. What should the network engineer configure on the routers to meet the immediate requirement?
Select an answer first
24application · medium
An administrator is configuring eStreamer on a Firepower Management Center (FMC) to send events to an external collector. The collector requires a secure connection and the administrator wants to ensure that events are not lost during a network interruption. What should the administrator configure?
Select an answer first
25expert · hard
A large enterprise is migrating from a legacy NetFlow v5 collector to a new IPFIX-based system. The network has many routers and switches. The migration must be seamless, and the team wants to ensure that the new collector can receive both NetFlow v5 and IPFIX during the transition. What is the best approach?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCIE-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-SECURITY” is a trademark of its owner, used for identification only.

3.6 Monitoring Protocols CCIE-SECURITY Practice Questions (Page 5)

Questions 21–25

Which SNMP version provides authentication and encryption?

Which SNMP operation is used by a manager to change a value on a managed device?

An administrator is configuring eStreamer on a Firepower Management Center (FMC) to send events to an external collector. The collector requires a secure connection and the administrator wants to ensure that events are not lost during a network interruption. What should the administrator configure?

Keep studying — 3.0 Security Infrastructure