At a hotel chain, NetFlow shows guest traffic suddenly shifting onto one WAN interface while the other circuits stay quiet. The NOC wants a page when that shift happens again. Which response fits?
Select an answer to reveal the explanation.
Short Explanation
A smoke alarm only helps if you wire it to the sensor that actually saw the smoke. You page from NetFlow, because that is the record of traffic moving onto one interface. A CPU alert, a chart with no rule, or a later capacity write-up will not catch the shift for you.
Full Explanation
NetFlow is already showing the guest traffic move onto one WAN interface while the other circuits stay quiet, so the page has to be fed by that same evidence. An alert on the NetFlow shift tells the NOC when the condition returns, which is the network-condition signal the operators asked for. An end-user CPU alert watches phones and lobby laptops. Processor load on a guest device does not record which WAN interface carried the flow, so it can stay quiet during a path shift and it can fire when the WAN is fine. A dashboard chart of the interfaces can draw the same shift, but with no alert rule behind it nobody is paged when the picture changes overnight. A capacity project may study whether the busy interface needs more room later, yet it does not page anyone when the shift happens again, so it is planning work rather than an alert. On the exam, match the alert to the telemetry that showed the condition; a chart of NetFlow is not yet a NetFlow alert. In production, trigger a test shift or replay a known busy interval and confirm the NetFlow rule opens a page, then confirm the page clears after traffic returns to the usual interfaces.