3.5 Explain the Implementation of Network Monitoring Tools for Real-Time Visibility SD-WAN-ENGINEER Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the primary use of syslog in network monitoring?

   • ATo authenticate users accessing the network
   • BTo collect and forward event messages from network devices to a central server
   • CTo measure bandwidth utilization on interfaces
   • DTo encrypt data in transit
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A network engineer needs to see real-time bandwidth utilization per application on a specific SD-WAN link and also wants to view the top talkers by volume. The engineer prefers a lightweight solution that does not require deep packet inspection. Which monitoring tool should be used?

   • AEnable NetFlow export on the SD-WAN device and use a flow collector that supports application identification based on port and IP.
   • BConfigure syslog to log all connection events and use a log analyzer to compute bandwidth per application.
   • CUse SNMP to poll interface counters and calculate per-application bandwidth based on the interface's IP addresses.
   • DDeploy a packet capture appliance that performs deep packet inspection to identify applications and top talkers.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which of the following is a common feature of a network monitoring dashboard?

   • AA command-line interface for configuring routing protocols
   • BA packet capture tool for deep inspection
   • CA text-based log viewer only
   • DReal-time graphs showing bandwidth utilization across WAN links
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security team wants to detect anomalous behavior on the SD-WAN, such as a sudden spike in traffic to a specific destination or a configuration change on a branch router. They have a SIEM that can correlate events, but they are concerned about the volume of data and want to ensure they capture the right events without overwhelming the SIEM. Which implementation should they choose?

   • AEnable SNMP traps for all events and send them to the SIEM, along with periodic SNMP polls for device metrics.
   • BConfigure syslog to send security-related events (e.g., authentication failures, configuration changes) and NetFlow to send flow records to the SIEM, and use correlation rules to detect anomalies.
   • CUse only syslog to capture all logs from all devices and send them to the SIEM for correlation.
   • DUse only NetFlow to monitor traffic and rely on flow anomalies to detect security incidents.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the primary role of SNMP in network monitoring?

   • ATo establish secure tunnels between SD-WAN sites
   • BTo capture and analyze individual data packets for security inspection
   • CTo collect device metrics and status information from network devices
   • DTo transfer log files from devices to a central server
   Reveal Solution Discussion Select an answer first