A network administrator is deploying RMON on a switch to monitor a critical segment. The switch supports RMON but has limited CPU resources. The administrator wants to minimize the impact on the switch while still being able to detect abnormal traffic patterns. What is the best approach?

Use an external RMON probe instead of the switch's built-in RMON.

Enable only the Statistics and History groups.

Use SNMP polling instead of RMON.

Enable all RMON groups on the switch.

A security operations center is using eStreamer to stream events from Firepower appliances to a SIEM. The SIEM is receiving events, but the volume is overwhelming and the team wants to filter out low-priority events before they reach the SIEM. What is the best way to achieve this?

Configure the eStreamer client to filter events based on severity.

Disable eStreamer and use SNMP traps for all events.

Increase the eStreamer buffer size to handle the volume.

Use syslog instead of eStreamer for low-priority events.

A company uses Cisco ASA firewalls at the perimeter. The security team wants to monitor connections that are denied by ACLs and also track the duration of established sessions. They plan to send this data to a central collector that already receives NetFlow from routers. What should the administrator configure on the ASA to provide this visibility?

Enable NSEL and configure the ASA to export security events to the NetFlow collector.

Use SNMP traps from the ASA to report ACL denies and session durations.

Configure traditional NetFlow on the ASA using the same record as on the routers.

Set up IPFIX on the ASA with a custom template for security events.

An administrator is integrating eStreamer with a SIEM. The SIEM vendor requires that events be sent in a specific format and over a secure channel. The administrator has configured eStreamer with TLS and a client certificate, but the SIEM is not receiving events. What is the most likely cause?

The SIEM is using the wrong port for eStreamer.

The eStreamer server is not running on the FMC.

The eStreamer client certificate is not trusted by the SIEM.

The eStreamer client is not configured to send events.

CCIE Security

Domain 3Objective 6

3.6 Monitoring Protocols CCIE-SECURITY Practice Questions (Page 7)

Part of the 3.0 Security Infrastructure domain, which accounts for 15% of the CCIE-SECURITY exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–1 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

11concepts

15%of the exam

Questions 31–35

31expert · medium
An organization is using RMON to monitor a segment. They want to detect when the number of CRC errors exceeds a threshold and send an alert to the NMS. The RMON probe is already collecting statistics. Which RMON groups need to be enabled to achieve this?
Select an answer first
32expert · hard
A network administrator is deploying RMON on a switch to monitor a critical segment. The switch supports RMON but has limited CPU resources. The administrator wants to minimize the impact on the switch while still being able to detect abnormal traffic patterns. What is the best approach?
Select an answer first
33expert · hard
A security operations center is using eStreamer to stream events from Firepower appliances to a SIEM. The SIEM is receiving events, but the volume is overwhelming and the team wants to filter out low-priority events before they reach the SIEM. What is the best way to achieve this?
Select an answer first
34application · medium
A company uses Cisco ASA firewalls at the perimeter. The security team wants to monitor connections that are denied by ACLs and also track the duration of established sessions. They plan to send this data to a central collector that already receives NetFlow from routers. What should the administrator configure on the ASA to provide this visibility?
Select an answer first
35expert · hard
An administrator is integrating eStreamer with a SIEM. The SIEM vendor requires that events be sent in a specific format and over a secure channel. The administrator has configured eStreamer with TLS and a client certificate, but the SIEM is not receiving events. What is the most likely cause?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCIE-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-SECURITY” is a trademark of its owner, used for identification only.

3.6 Monitoring Protocols CCIE-SECURITY Practice Questions (Page 7)

Questions 31–35

An organization is using RMON to monitor a segment. They want to detect when the number of CRC errors exceeds a threshold and send an alert to the NMS. The RMON probe is already collecting statistics. Which RMON groups need to be enabled to achieve this?

A network administrator is deploying RMON on a switch to monitor a critical segment. The switch supports RMON but has limited CPU resources. The administrator wants to minimize the impact on the switch while still being able to detect abnormal traffic patterns. What is the best approach?

A security operations center is using eStreamer to stream events from Firepower appliances to a SIEM. The SIEM is receiving events, but the volume is overwhelming and the team wants to filter out low-priority events before they reach the SIEM. What is the best way to achieve this?

An administrator is integrating eStreamer with a SIEM. The SIEM vendor requires that events be sent in a specific format and over a secure channel. The administrator has configured eStreamer with TLS and a client certificate, but the SIEM is not receiving events. What is the most likely cause?

Keep studying — 3.0 Security Infrastructure