Which Stealthwatch component is a physical or virtual appliance that aggrages and normalizes NetFlow data?

Question

Options

• AInvestigate
• BStealthwatch Management Center
• CFlow Collector
• DUOP Director

• A
  2% (1)
• B
  4% (2)
• C
  90% (46)
• D
  4% (2)

Explanation

Flow Collector (C) is the Stealthwatch component - available as either a physical appliance or virtual machine - that aggregates NetFlow, IPFIX, and other flow telemetry from network devices, then normalizes and deduplicates that data before sending it upstream for analysis.

Why the distractors are wrong:

• A. Investigate is a web-based interface/application used by analysts to query and visualize flow data - it consumes data, it doesn't collect it.
• B. Stealthwatch Management Console (SMC) is the centralized management and reporting hub that receives processed data from Flow Collectors and provides dashboards and policy configuration - it manages, not aggregates.
• D. UDP Director (not "UOP Director") is a flow replicator that forwards NetFlow data to multiple destinations - it routes data, but doesn't aggregate or normalize it.

Memory tip: Think of the Flow Collector like a funnel - it collects raw flows from many sources and pours normalized data upward to the SMC. If a question mentions "aggregates + normalizes NetFlow," that's your cue to pick the component with "Collector" in the name.

No community discussion yet for this question.