350-701 Question 108

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose A2

  To clarify, the flow-create event itself is not delayed—the event (the creation of a new flow) happens in real time on the ASA. What is delayed is the sending (export) of the flow-create event record to the NetFlow collector. In other words: The ASA detects and creates the flow immediately. The ASA can be configured to wait a specified amount of time before sending the flow-create event record to the NetFlow collector. This delay helps avoid logging very short-lived flows that might be torn down quickly, reducing unnecessary log entries. So, A is correct

• Chose A1

  D. is incorrect because "export" isn't in the answer. From the provided link: Filters NSEL events based on the traffic and event type through Modular Policy Framework, then sends records to different collectors. Traffic is matched based on the order in which classes are configured. After a match is found, no other classes are checked. The supported event types are flow-create, flow-denied, flow-teardown, flow-update, and all. Records can be sent to different collectors. For example, with two collectors, you can do the following: – Log all flow-denied events that match ACL 1 to collector 1. – Log all flow-create events to collector 1. – Log all flow-teardown events to collector 2. – Log all flow-update events to collector 1. • Delays the export of flow-create events.

• Chose A1

  I’ll go with A since Cisco ASA supports configuring multiple NetFlow collectors, which allows flow data to be sent to more than one monitoring or analytics platform