A retail bank needs to know which hosts exchanged how much data with a payment partner this afternoon, and it does not need the packet payload. Which record should the engineer collect?
Select an answer to reveal the explanation.
Short Explanation
NetFlow is the phone bill, and SPAN is a recording of the call. You want who talked, on which ports, and how many bytes, so you collect flow records and leave the payloads alone. A checkpoint is a picture of the configuration, not a picture of the afternoon traffic.
Full Explanation
NetFlow on NX-OS builds records of conversations: source and destination, ports, protocol, and byte and packet counts, then exports them to a collector. That is the record that answers which bank hosts exchanged how much data with the payment partner, without requiring the payload. SPAN copies frames from a source to a destination analyzer. It is the right tool when you need the packets themselves, and it is more data than this question asks for. A configuration checkpoint stores a point-in-time configuration that you can roll back to. It does not accumulate traffic counters for the afternoon. The OSPF link-state database describes topology and prefixes. LSAs do not store application byte totals between a host and a partner. Caveat: sampled NetFlow estimates volume from a sample of packets, so a compliance case that needs every frame still belongs on a capture, not on a sampled flow. Operational check: confirm the collector is receiving records for the partner addresses and that the byte counters cover the afternoon window you care about.