3.2 Explain Controller-Generated Incident, Alert, Statistics, and Audit Log Monitoring SD-WAN-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A network administrator is investigating a security incident where an unauthorized configuration change was made to the SD-WAN controller. The change was made using a valid administrative account. The administrator suspects that the account's password was compromised. What is the most important piece of evidence to look for in the audit log to confirm this suspicion?

   • AA pattern of login attempts from an unusual IP address or at unusual times, followed by the configuration change.
   • BThe exact configuration change that was made, to understand the impact of the change.
   • CThe current status of the configuration change, to see if it has been reverted.
   • DThe list of all other administrators who have access to the controller, to see who else could have made the change.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A network engineer is troubleshooting a site that is experiencing intermittent connectivity issues. The SD-WAN controller has generated several incidents for the site, but they all appear to be 'resolved' by the time the engineer checks the dashboard. The engineer wants to understand the root cause of the recurring issue. What is the most effective way to use the controller's monitoring data to investigate this?

   • AReview the audit log to see if any configuration changes were made to the site just before each incident.
   • BCheck the alert log for any alerts that were generated during the incidents, as they may contain more detail.
   • CIgnore the resolved incidents, as they are no longer active and do not require attention.
   • DAnalyze the statistics for the site around the times the incidents were generated to look for patterns in link quality, latency, or packet loss.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A network administrator is analyzing a report from the SD-WAN controller that shows a branch site's bandwidth utilization over the past month. The report indicates that the site consistently uses 90% of its primary link's capacity during business hours, but only 10% during off-hours. The administrator wants to use this data to make a recommendation. What is the most appropriate conclusion to draw from this controller-generated statistic?

   • AThe controller's statistics are inaccurate because they do not show a constant utilization rate, and the report should be disregarded.
   • BThe site's primary link is adequately sized for its current traffic patterns, as it never reaches 100% utilization.
   • CThe site's traffic pattern is predictable, which could justify a more cost-effective link plan or a policy to shape non-critical traffic during peak hours.
   • DThe site is experiencing a continuous network issue that requires immediate troubleshooting, as the utilization is not constant.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   How are controller-generated statistics typically presented to administrators?

   • AAs graphical dashboards and reports
   • BAs a list of configuration commands executed
   • CAs real-time alerts with severity levels
   • DAs a chronological log of events
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the primary role of audit logs in an SD-WAN environment?

   • ATo generate real-time alerts for network events
   • BTo collect performance statistics for capacity planning
   • CTo track administrative actions and configuration changes
   • DTo store traffic data for security analysis
   Reveal Solution Discussion Select an answer first