nerdexam
Cisco

350-701 · Question #347

An engineer is configuring their router to send NetfFow data to Stealthwatch which has an IP address of 1.1.1.1 using the flow record Stealthwatch406143794 command. Which additional command is require

The correct answer is B. match ipv4 ttl. To complete a NetFlow flow record definition for Stealthwatch, a 'match' command, such as match ipv4 ttl, is required to specify which fields of the IP flow data should be collected and matched.

Submitted by luis.pe· Mar 30, 2026Security Operations and Orchestration

Question

An engineer is configuring their router to send NetfFow data to Stealthwatch which has an IP address of 1.1.1.1 using the flow record Stealthwatch406143794 command. Which additional command is required to complete the flow record?

Options

  • Atransport udp 2055
  • Bmatch ipv4 ttl
  • Ccache timeout active 60
  • Ddestination 1.1.1.1

How the community answered

(19 responses)
  • A
    5% (1)
  • B
    79% (15)
  • C
    5% (1)
  • D
    11% (2)

Why each option

To complete a NetFlow flow record definition for Stealthwatch, a 'match' command, such as `match ipv4 ttl`, is required to specify which fields of the IP flow data should be collected and matched.

Atransport udp 2055

`transport udp 2055` is part of the flow exporter configuration, not the `flow record` itself. The record defines what to collect, the exporter defines where and how to send it.

Bmatch ipv4 ttlCorrect

When defining a NetFlow flow record using the `flow record <name>` command, it's essential to specify which fields should be included in the record. The `match` command is used to define key fields that form the identity of a flow, like source/destination IP, ports, and protocols. `match ipv4 ttl` is a valid command to include the IPv4 Time To Live field as part of the flow definition, which is a common requirement for comprehensive flow analysis.

Ccache timeout active 60

`cache timeout active 60` is related to the flow monitor configuration, specifically how long active flows are kept in the cache before export, not part of the `flow record` definition.

Ddestination 1.1.1.1

`destination 1.1.1.1` is part of the flow exporter configuration, specifying where the collected flow data should be sent, not part of the `flow record` definition.

Concept tested: Cisco NetFlow record configuration

Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/netflow/configuration/15-mt/nf-15-mt-book/cfg-nflow-exp-v9-v5.html

Topics

#NetFlow#flow record#match command#Stealthwatch integration

Community Discussion

No community discussion yet for this question.

Full 350-701 Practice