Free Cisco 350-701 Actual Exam Questions - Question 9 Discussion
DRAG DROP [Security Operations] Drag and drop the NetFlow export formats from the left onto the descriptions on the right. 
I think another good way to confirm is by remembering that NetFlow v5 is the oldest and most basic, so it’s definitely the one with fixed fields and IPv4-only support. v9 was introduced to add more flexibility and handle emerging network types but still isn’t as universal as IPFIX. IPFIX, being an IETF standard and designed as a successor, is meant for full extensibility like MPLS and IPv6 support. So matching them to their descriptions by how advanced and flexible they are makes sense here.
IPFIX matches the MPLS and IPv6 support description perfectly.
I’m with the idea that v5 is pretty limited, so it’s probably the one tied to just IPv4 and fixed fields. That leaves v9 and IPFIX for the more advanced features like MPLS and IPv6. Since IPFIX is based on IETF standards, it makes sense for it to handle flexible templates and newer protocols. So if the description talks about extensibility, that’s likely IPFIX, and v9 would be the middle ground with some but not all of those features. Makes the drag-and-drop a bit easier once you know what each version supports.
I think the key is knowing that IPFIX is more flexible and supports a wider range of protocols, which fits the description with MPLS and IPv6. That should help place IPFIX correctly versus the older NetFlow v5 or v9.
I ruled out the older versions for formats that mention MPLS and IPv6 support, so the newer NetFlow v9 or IPFIX must match those descriptions. That helps place the export formats more confidently.
Older NetFlow versions don’t have the MPLS support mentioned in the descriptions.
I ruled out the older NetFlow versions for the formats since they don’t support IPv6 or MPLS, so that helps narrow down which export format fits each description better.
Since the policy is already using default elements, adding addresses directly to identities (A) might make it easier to manage blocks without creating new lists. Could the identities list be the missing step here?
Is there any info on whether the policy supports destination lists? That might clarify if B is valid here or if adding addresses to identities (A) is the way to go.