3.2 Explain Controller-Generated Incident, Alert, Statistics, and Audit Log Monitoring SD-WAN-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which type of data is typically collected as controller-generated statistics in an SD-WAN environment?

   • AAdministrative login attempts
   • BConfiguration change history
   • CWAN link utilization and latency
   • DSecurity threat signatures
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A large enterprise has a hub-and-spoke SD-WAN topology. The controller generates an incident for a spoke site indicating that the site has lost connectivity to the hub. The incident is marked as 'active'. The network team checks the site's local router and finds that its WAN link is up and passing traffic. However, the controller still shows the incident as active. What is the most likely reason for this discrepancy, and what should the administrator do first?

   • AThe incident is based on the state of the physical link as reported by the router. The administrator should reboot the router to force a new status report to the controller.
   • BThe controller's incident is based on the state of the SD-WAN overlay tunnel, not the physical link. The administrator should check the tunnel status and the controller's ability to reach the spoke's management plane.
   • CThe incident is a false positive caused by a bug in the controller software. The administrator should ignore it and wait for the next software update.
   • DThe incident is a security alert indicating a potential breach. The administrator should immediately isolate the site from the network and conduct a forensic investigation.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An administrator notices that the SD-WAN controller is generating a high volume of alerts for a specific branch site. Upon investigation, the administrator finds that the alerts are all for the same minor issue: a single application experiencing slight jitter for a few seconds. The administrator wants to reduce the noise from these alerts without completely disabling alerting for the site. What is the most effective way to achieve this?

   • AAdjust the alert threshold for jitter so that minor, transient jitter does not trigger an alert, while more significant jitter still does.
   • BChange the alert notification method from email to SMS, as the team will be less likely to notice the alerts.
   • CDisable all alerts for the branch site, as the issue is minor and does not require monitoring.
   • DCreate a new alert rule that only applies to the branch site and set it to 'informational' severity, which will suppress it from the main alert view.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the role of controller-generated alerts in an SD-WAN environment?

   • ATo record all configuration changes for compliance purposes
   • BTo automatically resolve network issues without human intervention
   • CTo provide a historical record of network traffic patterns
   • DTo notify administrators of network events that may require attention
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A network administrator is monitoring the SD-WAN controller dashboard and sees a new incident for a remote site. The incident type is 'link quality degradation'. The administrator wants to know if this incident is a new problem or if it has occurred before. What is the most efficient way to determine the history of this incident type for this site?

   • AReview the audit log to see if any configuration changes were made to the site recently that could have caused the issue.
   • BCheck the incident history or log on the controller for previous occurrences of the same incident type for that site.
   • CContact the site's local administrator to ask if they have seen this issue before.
   • DLook at the current statistics for the site to see if the link quality is currently degraded.
   Reveal Solution Discussion Select an answer first