A parks department must identify which internal host is saturating a public-safety WAN link during an incident. Which visibility tool best exports flow records for top-talker analysis?
Select an answer to reveal the explanation.
Short Explanation
When the WAN is melting, you need a guest list of who is talking—not just a red light on the interface. Flexible NetFlow exports those conversations so you can spot the top talker fast. CRC counters and CDP will not name the bandwidth hog.
Full Explanation
Parks-department incident response that must identify which internal host saturates a public-safety WAN link needs conversation-level visibility. Exporting Flexible NetFlow records to a collector provides flow keys and counters for top-talker analysis. That is the appropriate visibility tool when the question asks for flow records rather than crude interface counters.
Disabling CEF and SPANning every VLAN continuously to a laptop is unsustainable and harms forwarding. Relying only on interface CRC counters shows errors, not conversations. Using CDP neighbor tables substitutes topology adjacency for accounting and cannot identify top talkers.
Exam caveat: Flexible NetFlow must define keys/monitors/exporters correctly; sampled NetFlow trades detail for scale on high-speed links. Operational check: enable an appropriate Flexible NetFlow monitor on the WAN edge, export to the collector, generate known flows, and confirm the saturating host appears in top-talker reports during the incident drill. Parks incident bridges should attach NetFlow top-talker screenshots to the ticket so public-safety WAN saturation has accountable remediation owners. Record the chosen control and rejected alternatives in the municipal change record so future on-call engineers understand the failure modes avoided for city services.