3.2 Explain Controller-Generated Incident, Alert, Statistics, and Audit Log Monitoring SD-WAN-ENGINEER Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An organization has a policy that requires the network team to be notified immediately when a branch site loses connectivity to the SD-WAN controller. The team wants to ensure that this notification is sent to their mobile devices as well as their email. What is the most appropriate way to configure this in the SD-WAN controller?

   • AConfigure the alert to be sent only to email, as that is the standard method for all notifications.
   • BConfigure the alert for site connectivity loss to have multiple notification methods, such as email and SMS or push notification.
   • CHave the team check the controller dashboard periodically for any new alerts.
   • DSet up a separate alert for each notification method, one for email and one for SMS, for the same event.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A network engineer notices that the SD-WAN controller has generated an incident for a branch site. The incident details show that the primary link to the data center has been down for 15 minutes, and the controller has already failed over traffic to the secondary link. The engineer wants to understand the current state of the incident and whether any action is required. What is the most appropriate way to determine the current status and required action for this controller-generated incident?

   • AReview the incident details in the controller's monitoring dashboard to see if it has been automatically resolved or if it is still active, then check the associated alert for any recommended remediation steps.
   • BImmediately open a ticket with the service provider to report the link failure, as all controller-generated incidents require manual intervention to resolve.
   • CUse the CLI on the branch router to verify the link status, and if the link is up, assume the incident is resolved without checking the controller.
   • DCheck the local syslog server on the branch router, as the controller does not retain incident history beyond the initial notification.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which type of incident is generated by the SD-WAN controller when a branch site's primary WAN link fails and traffic is automatically rerouted to a secondary link?

   • APerformance degradation incident
   • BSecurity threat incident
   • CConfiguration change incident
   • DLink failure incident
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   An organization has configured the SD-WAN controller to send alerts to a central monitoring team. The team wants to ensure they are only notified about significant events that require their attention, such as a complete site outage, and not about minor, transient issues like a single packet loss spike. Which alert configuration approach should the administrator use to achieve this?

   • ASet up a separate syslog server to receive all alerts and then create a script to forward only the first alert of each day to the team.
   • BDisable all alert generation on the controller and rely solely on periodic manual checks of the dashboard for any issues.
   • CConfigure alert rules based on severity levels and thresholds, so that only alerts matching the defined criteria for significant events are generated and sent to the team.
   • DConfigure the controller to send all alerts to the team and have the team manually filter out the minor events from their email client.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the primary purpose of controller-generated incidents in an SD-WAN environment?

   • ATo monitor network health by flagging significant events
   • BTo collect performance statistics for capacity planning
   • CTo provide real-time alerts for immediate action
   • DTo track configuration changes made by administrators
   Reveal Solution Discussion Select an answer first