201-01 Riverbed Certified Solutions Associate - Network Performance Management Questions and Answers

Low and High

Emergency, Critical, Alert, Error, Warning, Notice, Informational, and Debug

Critical, Warning, and Informational

System Down, System Impaired, Attack, SLA/SLO Violation, and Security Policy Violation

Low, Med, and High

Select a Capture Job, right-click, and select "Create Trace Clip".

Drag a bar from a Bar Chart to the Capture Job.

Click the + button in the Capture Job item and select a time window.

Select a time window and apply a Cascade Pilot filter.

Adding an alerting threshold for the policy in question

Adding the host or subnet to the special pre-defined custom hostgroup called “trusted-hosts” that suppresses alerting from all security policies.

Changing the Advanced Setting for the policy

Changing the Global Policy Settings

Suppressing events against a specific host or subnet is not possible

Cascade can determine every URL that a client goes to out on the internet.

Cascade can identify applications at Layer7 which will aid in determining business versus non-business use-age of resources.

Cascade can identify applications that use multiple common ports based upon Layer7 to more readily track application dependencies.

Cascade can be configured with URLs, match those URL’s to application names and, in order to understand which applications are utilized on web servers that host multiple web applications over the same TCP port.

Cascade can identify unencrypted applications such as FTP and TELNET regardless of port number, and other applications (such as Peer to Peer) that may violate a company’s security policies.

One or all views from the main workspace.

Notes entered associated with a view.

Analyst and Client information entered.

A and B.

A, B and C.

An optional module that is licensed separately and not available in the Cascade Pilot Personal Edition (PE) product.

A module that automatically generates expert reports of traffic selection in PDF format.

The source of packet traffic – either a device or a packet capture file.

Network traffic analysis displays that can be applied to traffic.

The cold cache response time, when the information is first requested from the database.

The response time from the warm cache, known as the First Response table.

The response time measured from the start of the database query to the receipt of the first response packet.

The response time measured from the start of the database query to the receipt of the final response packet.

The response time for stored procedure queries into the database.

Roll remote devices via SNMP at the request of NetProfiler.

Process up to tens of millions of raw flows per minute.

Provide analysis of incoming flows and identify anomalies in traffic patterns.

Selectively forward flows from original sources to third party colectors.

Selectively forward flows from original sources to NetProfiler(s).

250GB

500GB

750GB

1TB

NetFlow v5

CascadeFlow

IPFix

cflowd

NetFlow v9

All of the above

Packet-level detail with microsecond-level details.

Flow-level detail with one-minute level details.

Packet-level detail with nanosecond-level details.

Flow-level details with nanosecond-level details.

Packet-level detail with one-minute level details.

User Defined Policies

SNMP Polling

Dashboards

Services

Navigate Network

Unlimited

10

4

20

Flow level information including IP Addresses, number of packets, number of bytes, port/protocol, retransmissions and, when applicable, TCP response time information.

Port Statistical information including packet counts, byte counts, checksum error counts, and dropped packet counts.

Health information including CPU utilization, up-time, and fan health.

Cascade Shark cannot export data to Cascade Profiler.

Sufficient capacity within a virtualization infrastructure to support the minimum or recommended requirements for the software being deployed.

It is important to consider future growth within the organization and whether that growth will impact NetProfiler needs in the short and medium term future in terms of capacity, visibility, or other aspect.

Whether there is an existing virtualization deployment.

There are no important issues to consider when choosing whether to deploy a physical or virtual NetProfiler solution.

100,000 Flows per Minute

200,000 Flows per Minute

300,000 Flows per Minute

400,000 Flows per Minute

500,000 Flows per Minute

600,000 Flows per Minute

The traffic will be double counted.

Cascade will discard one of the flow records.

If both flows types are the same (e.g. NetFlow) Cascade will de-duplicate the records but if they are of different flow types, one record will be discarded.

Cascade will de-duplicate and consolidate the flow records regardless of source and flow type.

This is not possible.

Cascade Gateway’s poll Netflow sources via SNMP, while Cascade Profiler, Cascade Gateway and Cascade Sensor sync NTP from a common source.

Cascade Profiler’s poll Netflow sources via SNMP, while Cascade Profiler, Cascade Gateway and Cascade Sensor sync NTP a common source.

Cascade Profiler’s poll Netflow sources via SNMP, while Cascade Profiler is the NTP source for Cascade Gateways and Cascade Sensors.

Cascade Gateway’s poll Netflow sources via SNMP, while Cascade Profiler is the NTP source for Cascade Gateways, Cascade Sensors and Cascade Sharks.

SNMP polling is not supported in Cascade.

You would never deploy NetExpress at a large corporate enterprise. NetExpress has insufficient capacity for any type of deployment.

To provide a solution for collecting packets, with no need for any other sort of analysis.

Multiple locations in widely disparate geographic locations with a need to monitor each location independently.

A need to provide visibility to a subset of an entire organization such as a specific group or collection of groups. without providing that same visibility to the entire organization.

Host/Group

IP Address/Subnet

Interface/Device

Network

Service Health

Watched Traffic

WAN Utilization

Service Map

Security Threats

2

4

6

8

12

First creating a trace clip file.

First exporting the job trace to Wireshark.

First applying a high level view onto the job trace.

First indexing the job trace using the Cascade Pilot right-click menu.

Default Host Group Type to use on the User Interface and Reports

Whether hosts will be displayed by IP address or DNS/DHCP hostname

User’s Timezone to use for the User Interface and Reports

Option to control whether bandwidth is reported in Bits or Bytes

Host group definitions for mapping IP subnets into Custom host groups

TRUE

FALSE

1

2

3

4

5

It obtains L2 retransmissions from switches and routers via SNMP.

It obtains TCP retransmissions by tracking TCP segments via the Sensor.

Both A and B.

Cascade does not track retransmissions.

Cascade obtains retransmissions from Netflow (retransmissions are sent as a flag as part of standard netflow).

There is no reason to create this definition.

This definition can be used to look for all hosts on the network that are not in other groups.

This definition can be used to identify hosts that have incorrect IP address assignments.

This definition can be used to look for all hosts on the internal network that are not in other groups within the same group type.

This definition can be used to look for all hosts on the internal network that are not in other groups in any group type.

There is no difference between an Express and Standard Profiler.

An Express Profiler has the option only for a built-in Sensor and cannot receive flow data.

A Standard Profiler has the option only for a built-in Sensor and cannot receive flow data.

An Express Profiler can handle more flows per minute then a Standard Profiler.

An Express Profiler has a built in Sensor and Gateway.

Packet Collection Only

Flow Collection Only

SNMP Statistics Only

Flow Collection or Packet Collection

SNMP Statistics or Packet Collection

Definitions->Host Groups

Definitions->Applications

Definitions->Port Groups

Definitions->Port Names

Integration->Switch Port Discovery

5.5

5.0

5.1

4.0

Interface centric

Application centric

Host centric

Port centric

The Cascade Profiler does not have two approaches