What Is a Benefit of Cisco Tetration?
Describe network, application, and data security in cloud environments with solutions such as Cisco Multicloud Defense and Cisco Secure Workload
What is a benefit of using Cisco Tetration?
Answer
Correct answer: B — Cisco Tetration collects near-real-time server telemetry and maintains a software package inventory, exposing versions with known vulnerabilities.
Community Insight
The question tests whether you know Tetration separates telemetry collection from analytics, and the trap is attributing flow analysis to the software sensor itself rather than to the Tetration platform.
Cisco Tetration's benefit in this SCOR item is near-real-time server data collection plus a software-package inventory, which is why option B is correct. The page explains why sensor-based flow analysis in option D is the trap and how the Cisco datasheet supports B.
Learners often pick D because Tetration is known for telemetry and flow analysis, but the software sensor only collects host and flow information; it does not analyze it, making B the better-supported benefit.
Community Discussion (15 comments)
XBfoundX
👍 1
Selected: B
The answer is B, the agent itself is not analysis any kind of traffic. The agent is responsible for send telemetry traffic to Secure Workload, and is responsible to push the "policies" to the server that has installed the agent. The agent is just changing the windows firewall rules, or using iptables so that the rules are set directly to the local machine. https://www.cisco.com/c/en/us/products/collateral/security/stealthwatch/stealthwatch-tetration-aag.html
XBfoundX
👍 1
Here also further important details: A tetration software agent is a small software application running on a host system. Its core functionality is to monitor and collect network flow information. It also collects other host information such as network interfaces and active processes running on the system. The information collected by the agent is exported to a set of collectors running within the Tetration cluster for further analytical processing. https://www.cisco.com/c/en/us/td/docs/dcn/dcnm/1153/installation/lanfabric/cisco-dcnm-lanfabric-install-and-upgrade-guide-1153/tetration-agent.pdf
7d4c29f
👍 1
Selected: D
Tetration (Cisco Secure Workload) is a workload security platform that provides comprehensive visibility into data center and cloud environments through telemetry collection and flow analysis
Premium_Pils
👍 1
Selected: B
https://www.cisco.com/c/en/us/products/collateral/data-center-analytics/tetration-analytics/datasheet-c78-737256.html It says under "Features and Benefits": ● Get a baseline software inventory and the version information installed on servers. ● Quickly identify if any of the package versions have known vulnerabilities or exposures, along with the severity. ● Get an accurate inventory of all the servers that have the vulnerable package. ● Capture communication and process activities along with software package information to baseline the workload behavior.
Bubu3k
👍 1
Selected: B
"Cisco Secure Workload discovers the installed software packages and versions on your servers to report on known information..." source: https://www.cisco.com/c/en/us/products/collateral/data-center-analytics/tetration-analytics/datasheet-c78-740328.html
MPoels
👍 1
Selected: B
Tetration do not uses software sensors to analyze flow information (that is the claim of answer D). Sensors collect information (no analyzing-process). Tetration also does not collect "enforcement data" from servers. Tetration / Workload collect information from servers to process it for enforcement decisions.
LTLnetworker
👍 2
Selected: D
I found differences from data sheet in B and D
MPoels
👍 1
That was not stated in answer B either!
petestudies
👍 1
Selected: C
It's C. https://trustportal.cisco.com/c/dam/r/ctp/docs/privacydatasheet/security/cisco-tetration-privacy-data-sheet.pdf Inter-packet variation: Captures any inter-packet variations seen within the flow, including variations in the packet’s Time to Live (TTL), IP/TCP flags, packet length, etc.
LTLnetworker
👍 1
true but "enforcement data" is not mentioned in the data sheet
kvothe86
👍 2
Neither B nor D are accurately correct. The Cisco Tetration Analytics engine in the platform analyzes telemetry data gathered from host and network sensors using advanced machine-learning techniques to identify application dependencies. The platform delivers behavior-based application insight with deep forensics, providing real-time visibility into traffic across all Cisco data centers and a better understanding of dependencies among applications. https://www.cisco.com/c/en/us/solutions/collateral/enterprise/cisco-on-cisco/itb-aci-12192016_tetration-analytics-initial-implementation.html
lthiland
👍 1
I think B https://www.cisco.com/c/en_sg/products/data-center-analytics/tetration-analytics/index.html#~stickynav=1
jku2cya
👍 1
No idea which is more correct out of B and D. https://www.cisco.com/c/en/us/products/collateral/data-center-analytics/tetration-analytics/datasheet-c78-737256.html
egiunta
👍 4
I think B is correct (https://www.cisco.com/c/en/us/products/collateral/data-center-analytics/tetration-analytics/datasheet-c78-737256.html)
LTLnetworker
👍 1
"Near real-time compliance monitoring of all communications " BUT not from inventories
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Cisco Tetration, now positioned as Cisco Secure Workload, is a workload-security and visibility platform that ingests near-real-time telemetry from host agents and network sensors. Its datasheet explicitly lists a baseline software inventory with installed package versions and exposure severity, which is exactly what option B describes. That inventory helps teams identify vulnerable package versions on servers without relying only on periodic scans. Option B also correctly frames the data as coming from servers in near-real time, matching Tetration's agent-based collection model, so it is the concrete datasheet-backed benefit among the choices.Why the Other Options Are Wrong
Option A is superficially plausible because Tetration can report on policy compliance and process information, but "policy compliance data and process details" is not the benefit named in the source datasheet and is less specific than B. Option C invents "interpacket variation," which is not a Tetration collection function, and Tetration does not collect "enforcement data" from servers in that sense. Option D is the strongest distractor because Tetration does collect telemetry and flow information, but the software sensor does not analyze flows; the platform performs the analysis. That wording reverses the roles of sensor and analytics engine, so D is not the correct statement.Community Comment Notes
Learners citing the Cisco datasheet, including Premium_Pils and Bubu3k, focus on the software-inventory line and support B; Premium_Pils quotes "Get a baseline software inventory and the version information installed on servers." XBfoundX explains that the agent sends telemetry to Secure Workload and pushes policy to the host, rather than analyzing traffic itself. MPoels makes the same distinction, noting that sensors collect information while Tetration/Workload processes it for enforcement decisions. kvothe86 cautions that neither B nor D is worded perfectly, but the platform-level analysis description still undercuts D's claim that software sensors analyze flow information.Official Reference
Exam Strategy
When a Tetration or Secure Workload option mentions sensors, check whether the verb is collect or analyze; sensors collect and the platform analyzes. Also match the wording to the datasheet's software-inventory benefit rather than choosing a broad but imprecise policy statement.
Frequently Asked Questions
Why is option D wrong when Cisco Tetration uses software sensors?
Tetration's host sensors collect flow and process telemetry, but the analysis happens in the Tetration/Secure Workload platform. Option D reverses those roles by saying the sensors analyze flow information.
Does Cisco Tetration also collect policy compliance data, as option A says?
It can report policy compliance and process details, but the exam's datasheet-backed benefit here is near-real-time server data plus installed software-package inventory. Option A is too broad and not the listed benefit.