3.2 Explain Controller-Generated Incident, Alert, Statistics, and Audit Log Monitoring SD-WAN-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11application · easy

   A network administrator is required to provide a report to management detailing all changes made to the SD-WAN controller's configuration in the last month, including who made each change. The administrator needs to ensure the report is accurate and complete. What is the most reliable source of information for this report?

   • AThe administrator's own memory of the changes they made, as they are the only one who makes changes.
   • BThe controller's statistics report, which shows performance and usage data.
   • CThe controller's alert log, which contains notifications about network events.
   • DThe controller's audit log, which records all administrative actions and configuration changes with user attribution.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security analyst is investigating a potential security incident. The analyst finds that a configuration change was made to the SD-WAN controller that disabled a security policy. The change was made using an account that belongs to a network administrator. The network administrator denies making the change. The analyst needs to determine if the administrator's credentials were compromised. What is the most important piece of information to look for in the controller's audit log?

   • AThe timestamp of the configuration change and the source IP address from which the change was made.
   • BThe current status of the security policy, to see if it has been re-enabled.
   • CThe list of all other administrators who have access to the controller, to see who else could have made the change.
   • DThe exact configuration change that was made, to understand the impact of the change.
   Reveal Solution Discussion Select an answer first
4. 13application · easy

   A network manager is planning to upgrade the bandwidth at a remote branch office. The manager asks the administrator to provide data from the SD-WAN controller showing the actual bandwidth usage and application breakdown for the site over the last six months. Which controller feature should the administrator use to gather this information?

   • AThe incident report, which details network health issues and their resolution.
   • BThe audit log, which records administrative actions and configuration changes.
   • CThe alert log, which contains notifications about network events and incidents.
   • DThe statistics monitoring feature, which collects and presents performance and usage data, including bandwidth and application-level details.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A network administrator is preparing a monthly report for management on the performance of the SD-WAN network. The report needs to include data on link utilization, application usage, and any significant incidents. What is the most efficient way to gather this information from the SD-WAN controller?

   • AManually check each site's local router to gather the data, as the controller does not store this information.
   • BUse the audit log to gather all the information, as it contains a record of all network activity.
   • CUse the statistics monitoring feature to generate a report on link utilization and application usage, and review the incident log for significant incidents.
   • DUse the alert log to gather all the information, as it contains notifications about all network events.
   Reveal Solution Discussion Select an answer first
6. 15application · easy

   A security auditor is reviewing the SD-WAN environment and asks the network administrator to provide a record of all configuration changes made to the controller over the past 90 days, including who made each change and when. Which controller feature should the administrator use to fulfill this request?

   • AThe audit log, which records administrative actions and configuration changes with timestamps and user information.
   • BThe incident report, which details network health issues and their resolution status.
   • CThe alert log, which contains notifications about network events and incidents.
   • DThe statistics report, which shows performance and usage data for the network.
   Reveal Solution Discussion Select an answer first