3.3 Explain Alert and Notification Configuration SD-WAN-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company's SD-WAN administrator needs to send critical link-down alerts to the NOC team via email and also forward the same alerts to a central SIEM for correlation. The SIEM is configured to receive syslog messages. Which notification channels should be configured for the alert?

   • AEmail and webhook
   • BEmail and SNMP
   • CEmail and syslog
   • DSyslog and SNMP
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   An administrator wants to receive notifications only for critical alerts from a specific branch device. Which configuration would accomplish this?

   • ADisable all other alerts
   • BChange the notification channel to SNMP
   • CConfigure an alert filter with device and severity criteria
   • DSet the alert threshold to critical
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   An organization has multiple SD-WAN sites. The administrator wants to send email alerts for site A to the site manager, and alerts for site B to the regional manager. What is the most efficient way to configure this?

   • ACreate one alert rule with both recipients and no filter
   • BUse a single recipient group with both managers and apply it to all alerts
   • CConfigure SNMP traps for site A and email for site B
   • DCreate two separate alert rules, each with a different recipient and a filter for the respective site
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A branch office has a low-bandwidth link that is prone to flapping. The administrator wants to reduce alert noise by only notifying when the link has been down for at least 2 minutes. Which alert configuration setting should be adjusted?

   • AChange the notification channel to SNMP
   • BSet the alert severity to low
   • CDisable the alert and rely on manual monitoring
   • DIncrease the alert duration threshold to 2 minutes
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A security team wants to receive alerts for all high-severity security events, but only from devices in the 'DMZ' site. The administrator has created a security alert rule with a filter for the DMZ site. However, the team is also receiving alerts for medium-severity events. What is the most likely cause?

   • AThe severity threshold is set to 'low'
   • BThe notification channel is misconfigured
   • CThe filter does not include a severity criterion
   • DThe alert type is set to 'system' instead of 'security'
   Reveal Solution Discussion Select an answer first