3.2 Explain Controller-Generated Incident, Alert, Statistics, and Audit Log Monitoring SD-WAN-ENGINEER Practice Questions (Page 5)

Questions 21–24

1. 21expert · hard

   During a routine audit, a compliance officer asks the network administrator to prove that a specific configuration change to the SD-WAN controller was made by a particular administrator and not by another. The change was made two weeks ago. The administrator checks the audit log and finds the entry, but the username is not the one the officer asked about. The administrator suspects the change was made using a shared administrative account. What is the most appropriate next step to ensure accountability and prevent this issue in the future?

   • AModify the audit log entry to reflect the correct administrator's name, as the change was likely made by them.
   • BDisable the shared account and create unique user accounts for each administrator, enforcing their use for all future changes.
   • CIgnore the request, as the audit log is only for internal troubleshooting and is not meant to be used for compliance purposes.
   • DReview the audit log for other changes made around the same time and correlate them with the shared account's login times to determine who was likely logged in.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A network administrator is reviewing the SD-WAN controller's statistics for a site that has been experiencing intermittent performance issues. The administrator wants to see if the issues correlate with specific times of day or specific applications. What is the most effective way to use the controller's statistics monitoring feature to analyze this?

   • ACheck the audit log for any configuration changes made to the site around the time the issues started.
   • BGenerate a custom report that breaks down performance metrics by time and application for the affected site.
   • CLook at the overall average performance for the site over the past week to see if it is below the baseline.
   • DReview the alerts for the site to see if any were generated during the performance issues.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   How are controller-generated alerts typically categorized in an SD-WAN environment?

   • ABy the IP address of the affected device
   • BBy severity level, such as critical, warning, and informational
   • CBy the number of times they have occurred
   • DBy the time of day they are generated
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which of the following actions would be recorded in an SD-WAN audit log?

   • AA router sends a BGP update
   • BAn administrator modifies a QoS policy
   • CA user accesses a website
   • DA branch site's WAN link goes down
   Reveal Solution Discussion Select an answer first