A network administrator needs to capture traffic on a busy production link to troubleshoot an application performance issue. The administrator is concerned about the impact of the capture on the production traffic. Which approach minimizes the impact on production traffic?

Run tcpdump directly on the application server's interface.

Use a network tap inline between the switch and the server.

Enable NetFlow on the router and analyze flow records.

Configure a SPAN port on the switch and capture from a separate analysis port.

When planning a packet capture on a high-throughput link, which factor must be considered to avoid dropping packets?

CPU and memory resources of the capture system

Storage capacity for the capture files

Network interface card (NIC) speed

A network administrator wants to identify which internal hosts are communicating with a known malicious external IP over the past week. The organization has NetFlow enabled on all core routers, but does not have full packet capture. Which tool is best suited for this task?

A packet capture tool deployed on a single access switch.

A network log analysis tool that aggregates syslog messages from the routers.

A SIEM tool that only ingests firewall deny logs.

A flow-based traffic analysis tool that queries NetFlow records for the external IP.

CiscoCertified Network Professional Cybersecurity (CBRCOR)

Domain 2Objective 22

2.22 Describe Tools and Their Limitations for Network Analysis Such as Packet Capture Tools, Traffic Analysis Tools, Network Log Analysis Tools 350-201 Practice Questions (Page 7)

Part of the Techniques domain, which accounts for 30% of the 350-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 1–1 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

6concepts

30%of the exam

Questions 31–35

31foundation · medium
A network log analysis tool is receiving a massive number of events from multiple devices, causing delays in query responses. Which limitation is being experienced?
Select an answer first
32application · medium
A network administrator needs to capture traffic on a busy production link to troubleshoot an application performance issue. The administrator is concerned about the impact of the capture on the production traffic. Which approach minimizes the impact on production traffic?
Select an answer first
33foundation · medium
When planning a packet capture on a high-throughput link, which factor must be considered to avoid dropping packets?
Select an answer first
34application · medium
A network administrator wants to identify which internal hosts are communicating with a known malicious external IP over the past week. The organization has NetFlow enabled on all core routers, but does not have full packet capture. Which tool is best suited for this task?
Select an answer first
35foundation · medium
A network administrator wants to analyze traffic patterns and identify the top talkers on the network. Which type of tool is best suited for this task?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-201” is a trademark of its owner, used for identification only.

2.22 Describe Tools and Their Limitations for Network Analysis Such as Packet Capture Tools, Traffic Analysis Tools, Network Log Analysis Tools 350-201 Practice Questions (Page 7)

Questions 31–35

A network log analysis tool is receiving a massive number of events from multiple devices, causing delays in query responses. Which limitation is being experienced?

A network administrator needs to capture traffic on a busy production link to troubleshoot an application performance issue. The administrator is concerned about the impact of the capture on the production traffic. Which approach minimizes the impact on production traffic?

When planning a packet capture on a high-throughput link, which factor must be considered to avoid dropping packets?

A network administrator wants to identify which internal hosts are communicating with a known malicious external IP over the past week. The organization has NetFlow enabled on all core routers, but does not have full packet capture. Which tool is best suited for this task?

A network administrator wants to analyze traffic patterns and identify the top talkers on the network. Which type of tool is best suited for this task?

Keep studying — Techniques