Practice Free 299-01 Riverbed Certified Solutions Professional - Network Performance Management Exam Questions Answers With Explanation

Active Directory information for successful/failed login association to IPs

DHCP for host IP to MAC address association.

SNMP polling to routers, switches, and servers for CPU information.

SNMP trap data from routers, switches, and servers for security events.

SNMP polling to routers and switches for MAC address and physical switch port association.

Rebalance moves flows among analysers in a Cascade Enterprise Profiler.

Reallocate varies the storage space dedicated for templates and saved reports.

Rebalance optimizes the use of the allocated space that allows you to get a longer retention time out of the same amount of disk space.

Reallocate allows the users to decide the percent of total disk storage capacity that is allocated to the various flow logs.

Rebalancing and Reallocating must be done simultaneously.

UDP flow

TCP flow

An RST after the fifth data packet

Retransmitted ACK's

Retransmitted FIN's

The network setup (time between SYN to 1st ACK) is added together across the three segments: client to branch Steelhead appliance, branch Steelhead to DC Steelhead appliance, DC Steelhead appliance to the Server.

The Server Delay time minus the Client Delay time.

The top talker (server) that has sent the most data.

The network setup time reported by the Cascade Shark appliance, which is the time between the reported client-->server SYN and the 1st client-->server ACK.

You must have at least three days of history of 15 minute rollups before saving the analytic.

You must have at least three days of history of 15 minute rollups before the analytic initializes.

If you include all possible metrics, but there is no possibility of measuring response time due to lack of Sensor coverage, the analytic will fail to initialize.

The analytic will not alert for a minimum of 1 week during baseline collection.

Both B and C.

QIP

ISC

Infoblox

Windows DHCP

All of the above

None of the above

Enabled

Disabled

Set to retain up to 1 week or 10GB of indexing/trending data

Set to retain up to 1 week or 10GB of packets

Set to keep the indexing/trending data indefinitely

Host Scan

Port Scan

Link Availability

Suspicious Connection

There is no event that triggers before a worm event.

Internal hosts only

External hosts only

All hosts

Internal and External hosts only

Specified internal hosts plus the non-routable subnets

Ensures Cascade is able to recreate the packets.

Essential for the flow de-duplication process.

Ensures the flow is delivered to the correct Gateway.

All of the above.

None of the above.

Top Hosts

Top Applications

Public

Private

Devices and Interfaces Utilization

Packets can be captured from multiple capture ports on one Cascade Shark appliance.

The maximum length the packet data can be specified.

Packets can be filtered on host IP addresses.

SSL traffic can be decoded if the appropriate certificate are loaded in the Cascade Shark appliance.

The maximum storage bandwidth for the job can be specified in bits/sec.

Multiple packet capture jobs can run concurrently.

Cascade Sensor only

Cannot get QoS data on Cascade

Cascade Sensor and Cascade Gateway

CascadeFlow traffic only

NetFlow and IPFIX traffic only

At least three days of data available.

At least three weeks of data available.

The application specialist available.

Some historical data and some starting point (a server, port, application).

A customer network diagram available.

They all point to the same NTP server.

The Profiler, ideally, points to an NTP server (although it can use local time as well), the Gateway and Sensor get their time information from the Profiler which acts as their NTP Server.

For security reasons, all components use local time. The same time should be set on each component.

They all synchronize their time via timestamps in Netflow sources.

Peers

Peers and Ports

Host Pairs

Ports

Host Pairs and Ports

Steelhead

CE router

PE router

Netflow-enable hosts

Warn if either inbound or outbound traffic increases abnormally

Warn if an application component of traffic increases abnormally

Warn if traffic to/from specific hosts exceeds a specific utilization level

Warn if the response time across a link increases abnormally

Traffic between Virtual machines is not switched; it is routed by the standard vRouter included with ESXi

A standard or distributed vSwitch which comes with ESXi must be used, there is not 3rd party software available

A 3rd party virtual switch is required such as the CISCO Nexus 1000v as no standard vSwitch exists with ESXi

The included standard vSwitch of the CISCO Nexus 7000

The included standard vSwitch or the CISCO Nexus 1000v

Accessing the Cascade Profiler's MIB by third-party applications for monitoring.

Obtaining interface information from routers.

Obtaining host MAC address information from switches.

Obtaining network device status through the Cascade Profiler receiving SNMP traps.

A, B, and D.

Can be created from a single applied View.

Can work on local trace files only.

Can include more than two charts.

Is not available in the regular Cascade Pilot installation.

User name

Host IP address

Host MAC address

The physical switch port a specific host is connected to

Switch port traffic levels

Switch port status

SNMP traps from the switch

Is either a BPF or Wireshark Display filter only.

Can be created from a chart.

Can be changed after applying a View.

Is the equivalent of the Wireshark "display filter input".

Select two views from the views panel using control-click then right click on one and select "Create Interactive View" from the drop-down menu.

After a Drill-Down from one view to another, right click on the Drill-Down view in the sources panel and select "Create Interactive View" from the drop-down menu.

Select any item (such as a host IP Address, Port or Protocol name) in the main workspace and right click on the item, then select "Create Interactive View" from the drop-down menu.

Select any view in the views panel, right-click it and select "Create Interactive View" from the drop-down menu.

Open the filters panel, apply an existing or new filter to the view then select "save as interactive view" from the home menu.

SNMPv1 Only

SNMPv2 Only

SNMPv1 and SNMPv2

SNMPv1 and SNMPv3

All Service-based application performance policies

All Service-based policies plus all Performance and Availability analytic policies

All Service-based policies plus all Performance and Availability analytic policies plus all User-Defined Policies

All Service-based policies plus all Performance and Availability analytic policies plus all User-Defined Policies plus all Security policies

None of the above

Watched items (where items are hosts, interface, etc.)

Top items (where items are hosts, interface, etc.)

Top usernames

Unacknowledged Events

Current Events

Last Day Events

Nessus

Rapid7

Qualys

Retina

nCircle

MBSA

Stratified policy limits ranging from 5000 for Cascade Profiler Express platforms to 10,000 for Cascade Enterprise Profiler platforms

5,000 for all platforms

15,000 for all platforms

The Analytics license provides for an unlimited number of policies

None of the above

Network Round Trip measurement

Packet logging

Server Delay measurement

Connection Throughput measurement

Retransmission measurement

L7 application fingerprint checking

Applications, Ports/Protocols, QOS, Servers, Clients

Ports/Protocols, QOS, Servers, Clients

Applications, Ports/Protocols,

Applications, Ports/Protocols, QOS, Servers, Clients, Interfaces

No.

Yes, you can do this with the "ARIN" lookup in "external links". The customer can also add additional external links if they have other sites they use to look up IP Addresses.

This is available as a column in any report that displays the IP Address.

This is available under IP Host Group Type.

SNMP traps from the switches and routers

NetFlow v9

SNMP polling of the switches and routers

All of the above

None of the above

Client Ports

Applications

Ports

Server

Ability to identify Scanners and Worm Propagations.

Ability to provide information for a firewall rule when a user defined policy is violated.

Ability to alert on security policy (e.g. an insecure policies, such as FTP, is in use).

Ability to identify Worms by name.

The time span of the report does not cover any connection set-up points

Server delay is zero.

The protocol used by the application in not TCP-based.

Application traffic was not seen by a Cascade Sensor.

The server plug-in is needed to measure "Server Delay" and not functioning correctly.

from the Cascade Sensor

NetFlow

NBAR

Packeteer

User Defined

Enhanced sFlow

Average drops

Average retransmits

Average response time

Average utilization

Total bandwidth bits

25%

50%

75%

100%

None of the above

TCP Window size is observed as zero

Buffering bits (zeros) are included in the last packet of the flow

TCP is connectionless so there is no way to determine completion

A RST or FIN flag is included in the flow

A SYN or CPT flag is included in the flow

It uses IETF's IPFIX protocol.

Is uses whichever flow protocol it received the data on.

It uses a proprietary compressed and encrypted connection.

It sends data over SYSLOG port 514 which is compressed and encrypted via proprietary technology.

It sends data over TCP/41017.

tcp/8443

udp/123

tcp/41017

tcp/42999

tcp/123

By URL

By Regular Expression

By Packet Start offset

By ASCII String

By Hex String

By Error Code Type

Layer 1 information. For example, for Ethernet tap points this includes signal levels and attenuation.

Layer 2 information. For example, for Ethernet with 802.1Q encapsulation this includes the VLAN identifier and frame size between MAC Addresses

Layer 3 information. For example, for IPv4 this includes the protocol, time-to-live (TTL), and IP Identifier between IP Addresses

Layer 4 Transport information. For example, for TCP this includes TCP flags, size in bytes, and sequence number between IP Addresses.

Application header information. For example, for Web traffic this includes HTTP methods and message numbers (e.g. "200", "404").

Interface centric

Application centric

Host centric

Port centric

The Cascade Profiler does not have two approaches

Application performance

Link performance

Host performance

Application availability

Service level performance

Conformance verification

Link congestion

Hover your mouse over the name of the view.

Hover your mouse over the icon in front of the view name.

Open context-sensitive help with the view displayed.

Right-click within the main workspace and select "show view tool tip" from the right hand menu.

Application Sensor

Gateway

Profiler

All of the above

None of the above

UDP, TCP, or SCTP on any defined port

UDP only for any port or ports as defined by the operator

UDP only for a single port as defined by the operator

UDP and TCP for any port as defined by the operator

UDP/2055

Cascade Pilot Views Advanced Settings under the Settings menu

Port/Protocols Names and Port/Protocols Groups under the Port/Protocol Definition menu

Layer-4 Mappings and Application-Definitions under the Definitions menu

Layer-4 Mappings under the Advanced Settings menu

Defined as a BPF filter when configuring a Capture job

Profiler/Enterprise Profiler is entered into ICE (In Case of Emergency) mode to add 20% flow capacity. A total of 6 hours in ICE is licensed by default.

This limit is alarmed but flow capture is maintained until %110 of capacity is reached.

Flows over the flow limit are dropped.

Only source, destination, and total bites are entered into the database for over limit flows.

If the Steelhead is running a RioS version older than 5.5.3, the Steelhead WAN interfaces need to be manually added, and marked as Steelhead interfaces.

If the Steelhead is running a RioS version 5.5.3 or higher, the Steelhead WAN interfaces are automatically added to the WAN page, but the user must manually mark them as Steelhead interfaces.

If the Steelhead is running a RioS version 6.0.1 or higher, the Steelhead WAN interfaces are automatically added to the WAN page and are also be marked as a Steelhead interface.

All of the above are true.

A and C only are true.

Host Groups must be configured.

Cascade Profiler must be successfully polling Steelhead appliances via SNMP.

The WAN-Steelhead interface group must be populated with WAN interfaces for all Steelhead appliances.

The Profiler baseline collection must be complete.

A WAN Optimization reporting template must be configured.

Cascade Profiler can use switch port discovery to retrieve ARP and CAM tables directly from the NMS.

Most NMS' can be configured to SNMP Poll Cascade Profiler to retrieve conversation information.

Network API (from NMS via URL strings to get Cascade Reports)

There are no integrations; NMS' are competitors to Cascade Profiler.

External Links (from Cascade Profiler via URL strings to NMS)

A SPAN port captures traffic locally, an RSPAN captures traffic remotely

A SPAN port captures traffic consistently, an RSPAN captures traffic randomly

A SPAN port captures multiple ports while an RSPAN is "relational" and captures multiple VLANs (Relational LANs)

They are both the same with different terms being used by different vendors

A SPAN port is used on a Switch while a RSPAN is used on a Router

SNMP polling from the Gateway

SNMP polling from the Profiler

SYSLOG

All of the above

None of the above

The Network Operations Dashboard

The "Interface Information" Report available from the "Reports->Shortcuts" page

The "System > Information" page

The "System > Devices/Interfaces" page

Through Radius Server(s)

From Domain Controller(s)

Through LDAP queries

Via SNMP queries

The Profiler assigns a host to all overlapping custom groups.

The Profiler assigns a host to the custom group whose definitions has the shortest matching prefix.

The Profiler assigns a host to the custom group whose definitions has the longest matching prefix.

An error message is generated.

"192.168.1.0/24 Tokyo"

"Tokyo = 192.168.1.0/24"

"192.168.1.0-192.168.1.255 Tokyo"

"192.168.1.0;255.255.255.0 Tokyo"

Define an application availability analytic for the application being monitored

Define an interface-based user-defined policy

Enable the Bandwidth Surge security policy

Run a report that identifies any traffic flows that have had two different QoS taggings applied

Cascade does not have the capability to trigger such an alert.

Administrators, Operators, Monitors

Read-Only-Group, Read-Write-Group, Full-Access Group

Administrators, Network-Operations, Network-Security

Administrators, NormalUsers, Viewers

Administrators, Operators, Monitors, Viewers

In-chart tool controls

Data Retention Time

Chart Color scheme

Application of a Filter

Sampling Time

Connect a cross-over cable from your laptop to the Ethernet management port and connect through the Web browser to the default IP Address of 192.168.1.10.

Connect a cross-over cable from your laptop to the Auxiliary Ethernet port and connect through the Web browser to the default IP Address of 192.168.1.10.

Connect by KVM or Serial Console and run the command line tool, sa_wizard, to perform the initial configuration.

Connect to the appliance using the Riverbed Central Management Console (CMC) on its default IP Address and perform the initial configuration.

Per each capture job

Per each trace clip

Per each capture port

Per each capture board/aggregating port

Per each Cascade Shark appliance

v1 and v5

v7

v9

all of the above

none of the above

View Packets

Error Report

Restart Service

View Switch Port

External Link

About 34 hours with a captured length of 65535 bytes and a packet rate of 400kbps

About 9 hours with a captured length of 1000 bytes and an average traffic rate of 1Gbps.

About 18 hours with a captured length of 65535 bytes and an average traffic rate of 500Mbps.

About 20 hours with a captured length of 500 bytes and an average packet rate of 400kbps.