299-01 Practice Exam Questions with Answers Riverbed Certified Solutions Professional - Network Performance Management Certification

SNMPv1 Only

SNMPv2 Only

SNMPv1 and SNMPv2

SNMPv1 and SNMPv3

According to the Cascade Pilot time zone.

According to the time zone of the Cascade Shark to which you are connected.

According to Cascade Pilot time zone or optionally, to the Cascade Shark time zone as well.

According to UTC.

Allows Cascade Pilot to load views that take advantage of the Index more quickly.

Includes the number of bytes and packets for each conversation seen by the Cascade Shark appliance.

It is configured on a per-port basis.

It is configured using the sa-wizard as part of the initial configuration.

It is enabled by default per capture job.

Cascade Pilot is started with administrator privileges.

Cascade Shark is configured to show capture ports.

You apply a View to the interface and create a Watch on Web traffic.

You have privileges to do so in your user profile.

Interface centric

Application centric

Host centric

Port centric

The Cascade Profiler does not have two approaches

Controlling the portion of a packet capture (pcap) file analysed in the current view.

Creating a trace clip from a Cascade Shark appliance Capture job.

Controlling the size of a Capture Job created on a Cascade Shark appliance.

A and B

A, B, and C.

Host Baseline Profiles

Custom Port Definitions

Host Groupings

Mitigation Configuration

Firewall Configuration

Yes, 25

Yes, 50

Yes, 100

Yes 500

No Limit

Active Directory information for successful/failed login association to IPs

DHCP for host IP to MAC address association.

SNMP polling to routers, switches, and servers for CPU information.

SNMP trap data from routers, switches, and servers for security events.

SNMP polling to routers and switches for MAC address and physical switch port association.

On the Sensor, you must define either a hex string, text string, or URL.

On the Profiler, you must define either a hex string, text string, or URL.

On the Gateway, you must define either a hex string, text string, or URL.

You have to first enable security analytics on the Profiler, then you define either a string or URL on either the Profiler or the Sensor.

Custom applications cannot be defined, but the Sensor can identify most off-the-shelf programs.

Manually configure the interface speeds on the Devices/Interfaces page.

Configure and enable SNMP access to the reporting devices on the Devices/Interfaces page.

Enable NBAR on the routers.

Check the "Interface Utilization" box under the Devices/Interfaces page for each router and/or Steelhead desired.

Configure the appropriate Device Interface Analytic.

System Information > Devices/Interfaces

System Information > Profiler

Dashboard

Log in to the shell and view the /usr/mazu/var/log/Sensor.log

Ping devices on UDP port 2055 to see if they are up and running

Three weeks

Three days

One day

Configurable from one minute to three weeks

Application performance

Link performance

Host performance

Application availability

Service level performance

Conformance verification

Link congestion

One minute flow records are deleted from the file system FIFO (oldest first) once the appliance has filled the space that is allocated.

There is a fixed amount of space on the filesystem for completed reports.

A report template can be marked "keep until I delete it" so that any reports that are scheduled with this template are not automatically deleted from the filesystem.

When the flows or rollup records have been deleted from the filesystem, any saved report that was generated from those flow sources is no longer available.

Users have the ability to allocate additional space to the 1 min flow logs in order to increase retention. This is done at the expense of other rollup resolutions.

Event Manager

Dispatcher

User Interface

Database

50

75

100

125

Unlimited

User name

Host IP address

Host MAC address

The physical switch port a specific host is connected to

Switch port traffic levels

Switch port status

SNMP traps from the switch

Ability to identify Scanners and Worm Propagations.

Ability to provide information for a firewall rule when a user defined policy is violated.

Ability to alert on security policy (e.g. an insecure policies, such as FTP, is in use).

Ability to identify Worms by name.

Stratified policy limits ranging from 5000 for Cascade Profiler Express platforms to 10,000 for Cascade Enterprise Profiler platforms

5,000 for all platforms

15,000 for all platforms

The Analytics license provides for an unlimited number of policies

None of the above

Unlimited

Ten

Four

Twenty

The smallest bandwidth and packet count recorded by the five devices.

The largest bandwidth and packet counts recorded by one of the interfaces on one of the five devices.

The mean bandwidth and packet count recorded by the five devices.

The highest LAN packet count recorded by either Steelhead.

None of the above – the flow records store only the first byte and packet count reported by any of the reporting devices.

Cascade Profiler local database

User account specifies authentication by RADIUS

TACACS

RADIUS server to authenticate the user

Switch Port Discovery Protocol (SPDP)

Merging of CAM + ARP tables, both gathered via SNMP

Merging of IF and ARP tables, both gathered via SNMP

Merging of IF and CAM tables, both gathered via SNMP

Longest Match

Shortest Match

IP & Port

IP

Internal hosts only

External hosts only

All hosts

Internal and External hosts only

Specified internal hosts plus the non-routable subnets

80/tcp

8080/tcp

8090/tcp

443/tcp

22/tcp

Select two views from the views panel using control-click then right click on one and select "Create Interactive View" from the drop-down menu.

After a Drill-Down from one view to another, right click on the Drill-Down view in the sources panel and select "Create Interactive View" from the drop-down menu.

Select any item (such as a host IP Address, Port or Protocol name) in the main workspace and right click on the item, then select "Create Interactive View" from the drop-down menu.

Select any view in the views panel, right-click it and select "Create Interactive View" from the drop-down menu.

Open the filters panel, apply an existing or new filter to the view then select "save as interactive view" from the home menu.

Edit each Service policy to increase the Tolerance slider for Low and High alerts.

Edit each Service policy and set a noise floor to specify the minimum amount of change that the policy can treat as deviation from normal behavior.

Edit the Service and select fewer metrics to monitor for each segment that comprises the Service.

Modify the location host group type used for monitoring end user traffic to use fewer groups (for example, Region instead of Site).

A, B, C, and D.

A and B only.

192.168.1.120 is not in the 192.168.1.0/25 subnet

192.168.1.120 has been input as a trusted host in a security policy

Traffic to 192.168.1.120 was not picked up by a Sensor

Traffic to 192.168.1.120 was not picked up by a Gateway

192.168.1.120 never sent any traffic

Definitions->Host Groups

Definitions->Applications

Definitions->Port Names

Definitions->Port Groups

Integration->Switch Port Discovery