How to Monitor Historical WAN IP Traffic Without Network Sensors?
The cybersecurity department needs to monitor historical IP network traffic on the WAN interface of the outside router without installing network sensors. Which of the following would be best to allow the department to complete this task?
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
This question tests the difference between flow-based monitoring (NetFlow) and device management/remote access protocols; the trap is selecting SNMP because it monitors network devices, but it does not provide historical flow records of IP traffic.
For monitoring historical IP traffic on a router's WAN interface without additional sensors, enabling NetFlow is the correct approach. Community consensus strongly supports answer A, as NetFlow provides flow-level traffic data directly from the router.
The most common wrong answer is C (SNMP), because SNMP is a network management protocol, but it only polls device counters and status—it cannot capture and store historical IP traffic flows like NetFlow can.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
NetFlow is a flow-oriented protocol that captures metadata about IP traffic, including source/destination IP, ports, protocols, and packet counts. Enabling NetFlow on the WAN interface allows the router itself to collect and export traffic flow data for historical analysis, with no additional network sensors required. Community comment [1] directly states that to monitor historical IP network traffic without installing network sensors, the best option is A. Comment [2] reinforces that NetFlow is a Cisco network protocol for collecting IP traffic information, making it suitable for this task.
Why the Other Options Are Wrong
SSH (B) is for secure remote command-line access to a router; it does not provide traffic monitoring or historical flow data. SNMP (C) can monitor interface statistics and status, but it is not designed to provide deep, historical IP flow records with far-end/source-destination details. 802.1Q (D) is a VLAN tagging standard and has nothing to do with traffic monitoring. Comment [2] correctly notes that SSH, SNMP, and 802.1Q serve different purposes, such as secure remote access, device management, and VLAN tagging.
Community Comment Notes
The comments are unanimous in favor of A. Comment [1] made the concise statement that the task is achieved by enabling NetFlow on the interface. Comment [3] adds a common mnemonic: "Network traffic is almost always NetFlow," highlighting that flow analysis is the expected tool for traffic inspection. Comment [4] explains NetFlow's value for capturing source/destination addresses, ports, protocols, and volume, which are exactly the kind of historical traffic metrics needed by cybersecurity monitoring.
Official Reference
Exam Strategy
Whenever a question asks about monitoring or analyzing IP traffic on a router without adding sensors, choose NetFlow or IPFIX—not SNMP or SSH. Remember that NetFlow is about traffic flows, while SSH is remote access and SNMP is device status monitoring; eliminate those quickly.