What is a capability of Cisco ASA Netflow?

Question

Options

• AIt sends NetFlow data records from active and standby ASAs in an active standby failover pair.
• BIt filters NSEL events based on traffic.
• CIt logs all event types only to the same collector.
• DIt generates NSEL events even if the MPF is not configured.

• B
  91% (21)
• C
  4% (1)
• D
  4% (1)

Explanation

Cisco ASA's NetFlow Secure Event Logging (NSEL) uses the Modular Policy Framework (MPF) to selectively export flow records, meaning you can define class maps and policy maps to filter which traffic generates NSEL events - making B correct.

Why the distractors are wrong:

• A is incorrect because in an active/standby failover pair, only the active ASA sends NetFlow records; the standby unit does not independently generate or transmit NSEL data.
• C is incorrect because ASA NSEL supports multiple collectors and allows different event types to be sent to different collectors - not all to the same one.
• D is the opposite of reality: NSEL requires MPF to be configured; without a policy map enabling it, no NSEL events are generated at all.

Memory tip: Think of NSEL as "NetFlow with a filter knob" - the MPF is the knob. No knob = no events (eliminates D), and the knob lets you target specific traffic and specific collectors (confirms B, eliminates C). For failover, remember "active does the talking" (eliminates A).

No community discussion yet for this question.