3.5 Explain the Implementation of Network Monitoring Tools for Real-Time Visibility SD-WAN-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A network engineer needs to identify which applications are consuming the most bandwidth on an SD-WAN link during peak hours. The engineer wants to see per-flow details such as source/destination IP, port, and protocol, and also wants to set a threshold that triggers an alert when a specific application's traffic exceeds a defined rate. Which monitoring approach should the engineer use?

   • AEnable syslog logging on the SD-WAN devices and parse the logs for application usage patterns, then create alerts based on log message frequency.
   • BEnable NetFlow export on the SD-WAN devices and configure a flow collector with alerting rules based on application signatures.
   • CConfigure SNMP traps on the SD-WAN devices to send interface utilization data to the NMS, and set thresholds on the NMS for interface utilization.
   • DUse the SD-WAN management dashboard's built-in charts to view historical bandwidth usage, and manually monitor for spikes.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the primary purpose of flow-based monitoring protocols like NetFlow and sFlow?

   • ATo authenticate users accessing the network
   • BTo encrypt traffic between SD-WAN sites
   • CTo manage device configurations centrally
   • DTo provide real-time insights into network traffic patterns and usage
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security operations team needs to receive real-time alerts when an SD-WAN device detects a potential intrusion attempt or a configuration change. The team already has a SIEM platform that can correlate events from multiple sources. Which monitoring implementation should be used to feed the SIEM with the necessary data?

   • ARely on the SD-WAN management platform's built-in alerting and have it email the security team directly.
   • BUse NetFlow export to send flow records to the SIEM, which can then detect intrusion attempts based on flow patterns.
   • CEnable SNMP traps on the SD-WAN devices and configure the SIEM to receive and interpret the traps as security events.
   • DConfigure the SD-WAN devices to send syslog messages to the SIEM, and set up correlation rules on the SIEM to generate alerts.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A network team is troubleshooting a performance issue on an SD-WAN link. They suspect that a specific application is consuming excessive bandwidth, but they are unsure which one. They need to see real-time per-flow data and also want to compare current traffic patterns with historical baselines. The team has a NetFlow collector that stores flow records. Which approach should they take?

   • AEnable SNMP polling on the router to get real-time interface utilization and compare it with historical SNMP data.
   • BUse syslog to capture all connection logs and analyze them for bandwidth usage patterns.
   • CQuery the NetFlow collector for current top flows by application and compare them with historical data from the same time period on previous days.
   • DDeploy a packet capture tool to capture all traffic on the link and analyze it in real time.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A NOC supervisor wants to provide a real-time operational view of the SD-WAN to non-technical stakeholders, showing overall network health, active alerts, and application performance. The supervisor wants the view to be easily understandable and require minimal training. Which approach should be taken?

   • AExport NetFlow data to a spreadsheet and create charts manually for the stakeholders.
   • BSend daily email reports summarizing network health and application performance.
   • CConfigure a dashboard on the SD-WAN management platform that displays key performance indicators (KPIs) such as link status, application response time, and active alerts using simple visualizations.
   • DProvide stakeholders with direct access to the SNMP NMS so they can query device metrics themselves.
   Reveal Solution Discussion Select an answer first