4.5 Compare the Characteristics of Data Obtained from Taps or Traffic Monitoring and Transactional Data (NetFlow) in the Analysis of Network Traffic 200-201 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A network administrator needs to capture traffic on a high-speed link to analyze a protocol implementation issue. The administrator needs to see every packet, including any that may have physical-layer errors. Which data source should be used?

   • ANetFlow export
   • BNetwork TAP inline
   • CSPAN port on the switch
   • DRouter debug commands
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security engineer is designing a monitoring solution for a critical server farm. The solution must capture all traffic with zero impact on the production network and must be able to see both directions of every conversation. Which approach should the engineer implement?

   • AUse a router with port mirroring
   • BDeploy passive network TAPs
   • CConfigure SPAN on the access switches
   • DEnable NetFlow on the server farm switch
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A network administrator needs to monitor traffic patterns across multiple sites to identify unusual communication between internal hosts. The administrator has limited storage and needs to retain data for 90 days. Which data source is best suited for this multi-site monitoring?

   • ASyslog from each site's firewalls
   • BNetFlow export from each site's routers
   • CFull packet capture at each site
   • DSPAN port mirroring to a central server
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company needs to retain network traffic data for one year for compliance purposes. They have limited storage and need to minimize costs. They only need to know which hosts communicated with each other and the volume of traffic, not the content. Which data source is most appropriate for long-term retention?

   • ASPAN port mirroring to a storage array
   • BNetFlow records
   • CSyslog logs from network devices
   • DFull packet capture
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A network engineer is troubleshooting intermittent connectivity issues on a link. The engineer suspects that the switch is dropping frames due to oversubscription on a SPAN session. The engineer has access to both a TAP and the switch's SPAN configuration. Which action would provide the most reliable data to confirm the issue?

   • AEnable NetFlow on the switch to monitor dropped packets
   • BDeploy a TAP and compare the captured traffic with the SPAN output
   • CUse the switch's interface counters to check for CRC errors
   • DIncrease the SPAN session's buffer size
   Reveal Solution Discussion Select an answer first