How to Monitor Historical WAN IP Traffic Without Network Sensors?

N10-008 By islever Editorial Last updated

Short answer

A Enabling NetFlow on the interface

Question

The cybersecurity department needs to monitor historical IP network traffic on the WAN interface of the outside router without installing network sensors. Which of the following would be best to allow the department to complete this task?
  1. Enabling NetFlow on the interface Correct Answer
  2. Enabling SSH on the interface
  3. Enabling SNMP on the interface
  4. Enabling 802.1Q on the interface

Key Takeaways

This question tests the difference between flow-based monitoring (NetFlow) and device management/remote access protocols; the trap is selecting SNMP because it monitors network devices, but it does not provide historical flow records of IP traffic.

For monitoring historical IP traffic on a router's WAN interface without additional sensors, enabling NetFlow is the correct approach. Community consensus strongly supports answer A, as NetFlow provides flow-level traffic data directly from the router.

Common mistake: The most common wrong answer is C (SNMP), because SNMP is a network management protocol, but it only polls device counters and status—it cannot capture and store historical IP traffic flows like NetFlow can.

Expert Analysis

Why the Answer Is Correct

NetFlow is a flow-oriented protocol that captures metadata about IP traffic, including source/destination IP, ports, protocols, and packet counts. Enabling NetFlow on the WAN interface allows the router itself to collect and export traffic flow data for historical analysis, with no additional network sensors required. Community comment [1] directly states that to monitor historical IP network traffic without installing network sensors, the best option is A. Comment [2] reinforces that NetFlow is a Cisco network protocol for collecting IP traffic information, making it suitable for this task.

Why the Other Options Are Wrong

SSH (B) is for secure remote command-line access to a router; it does not provide traffic monitoring or historical flow data. SNMP (C) can monitor interface statistics and status, but it is not designed to provide deep, historical IP flow records with far-end/source-destination details. 802.1Q (D) is a VLAN tagging standard and has nothing to do with traffic monitoring. Comment [2] correctly notes that SSH, SNMP, and 802.1Q serve different purposes, such as secure remote access, device management, and VLAN tagging.

Community Comment Notes

The comments are unanimous in favor of A. Comment [1] made the concise statement that the task is achieved by enabling NetFlow on the interface. Comment [3] adds a common mnemonic: "Network traffic is almost always NetFlow," highlighting that flow analysis is the expected tool for traffic inspection. Comment [4] explains NetFlow's value for capturing source/destination addresses, ports, protocols, and volume, which are exactly the kind of historical traffic metrics needed by cybersecurity monitoring.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Whenever a question asks about monitoring or analyzing IP traffic on a router without adding sensors, choose NetFlow or IPFIX—not SNMP or SSH. Remember that NetFlow is about traffic flows, while SSH is remote access and SNMP is device status monitoring; eliminate those quickly.

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. a87d6a4 👍 3 Answered A
    A. Enabling NetFlow on the interface NetFlow is a network protocol developed by Cisco for collecting IP traffic information. By enabling NetFlow on the WAN interface of the router, the cybersecurity department can monitor and analyze historical IP network traffic without needing additional sensors. The other options—SSH, SNMP, and 802.1Q—serve different purposes: SSH is for secure remote access, SNMP is for network management and monitoring, and 802.1Q is used for VLAN tagging.
  2. Marinos_89 👍 3 Answered A
    To monitor historical IP network traffic on the WAN interface of an outside router without installing network sensors, the best option is A. Enabling NetFlow on the interface.
  3. priestb3 👍 2 Answered A
    Network traffic is almost always NetFlow
  4. dvdlau 👍 1 Answered A
    NetFlow provides detailed statistics on IP traffic, allowing for comprehensive monitoring and analysis of network flows. It captures data on network traffic, such as the source and destination IP addresses, ports, protocols, and volume of traffic.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

How to Resolve Printer-Workstation Connectivity Issues?

S-grade

Why Can a Workstation Reach the Internet but Not Internal Resources?

S-grade

Database server slow on access switch: move to core switch?

S-grade

Which Factor Most Impacts IDF Physical Design?

S-grade

← Back to N10-008 Study Guide