Network Operations CCIE-ENTERPRISE-INFRASTRUCTURE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A network engineer is troubleshooting a slow application performance issue. The application uses TCP. The engineer suspects packet loss on the network. Which tool or method would provide the most direct evidence of packet loss?

   • ACheck the interface counters on the switches for CRC errors.
   • BCapture traffic on the client and server and analyze TCP retransmissions.
   • CRun a ping with a large packet size and high count to the application server.
   • DUse traceroute to see where packets are dropped.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   While analyzing a packet capture, a network engineer sees a high number of TCP packets with the RST flag set from a server to a client. The client is trying to establish a connection to the server on port 443. What is the most likely cause?

   • AThe server's firewall is blocking the connection and sending RST packets.
   • BThe client is sending too many SYN packets, causing the server to reset.
   • CThe client is using an incorrect IP address for the server.
   • DThe server's application is not listening on port 443.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A network engineer needs to capture traffic on a switch to troubleshoot a problem with a specific application that uses UDP port 5004. The engineer wants to see only the traffic to and from a particular server IP address. What is the most efficient way to configure the capture?

   • AConfigure a SPAN session to monitor the entire VLAN and apply a filter for the server's IP address and UDP port 5004.
   • BConfigure a SPAN session to monitor the server's port and apply a filter for UDP port 5004.
   • CUse tcpdump on the server to capture traffic on UDP port 5004.
   • DConfigure an ERSPAN session to send traffic to a remote analyzer and filter on the server's IP address.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A network engineer is troubleshooting intermittent voice-quality issues on a remote branch office. The branch router supports only local SPAN, and the engineer needs to capture traffic from the WAN interface to analyze jitter and packet loss. The capture must include only RTP traffic to/from the voice gateway. What should the engineer do?

   • AUse tcpdump on the branch router's CPU to capture all traffic, then filter the resulting PCAP file for RTP.
   • BConfigure a local SPAN session on the branch router, specifying the WAN interface as the source and a PC connected to a switch port as the destination, then apply a capture filter for UDP port ranges used by RTP.
   • CEnable ERSPAN on the branch router and send encapsulated copies to the central NMS for analysis.
   • DConfigure an RSPAN session on the branch router, using a VLAN as the destination, and then capture on the remote switch.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A network engineer needs to capture traffic on a high-availability link between two core switches to analyze a routing protocol adjacency issue. The engineer wants to see only OSPF hello packets. Which capture method and filter would be most appropriate?

   • AUse RSPAN with a VLAN that includes the link, and capture all traffic.
   • BUse tcpdump on the switch's CPU to capture all traffic and then filter for OSPF.
   • CUse a local SPAN session on one switch, mirroring the link, and apply a filter for IP protocol 89.
   • DUse ERSPAN to send the capture to a remote analyzer, filtering for UDP port 520.
   Reveal Solution Discussion Select an answer first