201-01 Riverbed Certified Solutions Associate - Network Performance Management Questions and Answers

Front-end request to back-end connection mapping in Citrix XenApp environments.

User-to-Citrix desktop mapping in Citrix XenDesktop environments.

Citrix desktop server resource utilization measurements.

Optimized traffic response times through the Riverbed SteelHead CX model appliances.

Real-time Citrix decodes.

2

10

100

No limit

Windows Server 2003 or Windows Server 2008

Windows XP, Windows Vista, or Windows 7

Cascade Pilot is not specific to an operating system since access is through any standard web browser.

Any operating system supported by Wireshark

Default Host Group Type to use on the User Interface and Reports

Whether hosts will be displayed by IP address or DNS/DHCP hostname

User’s Timezone to use for the User Interface and Reports

Option to control whether bandwidth is reported in Bits or Bytes

Host group definitions for mapping IP subnets into Custom host groups

change the Navigation Bar Position.

change were reports are saved on Profiler.

change data unit from Bytes to Bits.

change user Time Zone.

search for lost templates.

Cascade Shark interfaces and captures job traces appear under the devices tab within the sources panel.

Cascade Shark interfaces appear under the devices tab of the sources panel AND Cascade Shark capture job traces appear under the files tab of the sources panel.

Cascade Shark interfaces and captures job traces appear in the views panel.

Cascade Shark interfaces must be selected from the home menu to begin a capture.

Unlimited

10

4

20

Ability to understand the response time of the Data Center as a whole.

Ability to map out the inter-server dependencies between applications in the data center.

Ability to map out the intra-server application/process dependencies on a server.

Ability to compare WAN Optimization benefits for different versions of Windows Server software

2; the standard Profiler and a Sensor or Gateway or Shark

2; the standard Profiler and an Express

1; the standard profiler

3; the Event Manager, the Database Manager, and the User Interface Manager

3; the standard Profiler, a Database chassis, and an Analyzer chassis

Bandwidth Utilization and Storage Utilization

Encryption Algorithms used

Signal to Noise Ratio of Fiber Optic Links

User Access Roles per Data Set

Bandwidth Utilization and Application Performance

From the User Management section of the Web Interface

From the Basic Settings page of the Web Interface

From the Users menu of Cascade Pilot

From the Advanced Settings page of the Web Interface

A security profile can be created for “business hours” or “weekends” or any other time periods you want to specify.

Security Profiles utilize the SNORT Threat Signature Database.

Security Profile data is aged out after one month.

Security Profiles negate the need for IDS/IPS type systems.

The appliance collects traffic data from the monitored network and aggregate it into security profiles.

Recent statistics play a larger role in the profile than older statistics.

User-Defined Policies are used only to compare current traffic against fixed values while other policies may allow you to compare traffic against both fixed values and a baseline, depending on the type of policy.

User-Defined Policies can be used to compare current traffic against a baseline of traffic built over the past several days, weeks, and months, while other policies compare current traffic against fixed values only.

User-Defined Policies allow you to set a minimum amount that a policy must change by before an alert will be created, whereas other policies do not.

There are no specific differences between User-Defined Policies and other policies, except the names of the policies.

TRUE

FALSE

NetExpress is only good for extremely tiny enterprises with a few hundred hosts that want a single, company-wide visibility monitoring solution.

Small enterprises with a few thousand hosts that want a single, company-wide visibility monitoring solution.

Large enterprises with hundreds of thousands of hosts that want a single, company-wide visibility monitoring solution.

NetExpress is a good solution for any sized organization that want a single, company-wide visibility monitoring solution.

Medium-size enterprises with tens of thousands of hosts that want a single, company-wide visibility monitoring solution.

Kerberos

RADIUS

Diameter

TACACS+

802.1x

Definitions- > Host Groups

Definitions- > Applications- > Layer-7

Definitions- > Port Groups

Definitions- > Port Names

Integration- > Switch Port Discovery

NetProfiler

Flow Gateway

NetExpress

NetShark

Windows 7 SP 1

MAC OS X

Windows 8

Windows 8.1

MGCP

SCCP

H.248

SIP

H323

sFlow

Netflow (v5 and v9)

IPFIX

SteelFlow-Net sources

Syslog

use mirror ports or passive taps to collect data from a network segment.

can forward packets to other network management systems.

provide deep packet inspection to identify the application being accessed by a host.

can decrypt secure protocols.

communicate with Profiler appliance using compressed and encrypted data.

Through the Reporting ribbon

Through the search bar in the Views pane

By hovering the cursor over the icon that precedes each View listed in the Views pane

Through the Web Interface

Sensor

Gateway

Express Profiler

Standard Profiler

Enterprise Profiler

They are cached for later processing.

They are ignored/dropped.

The user is able to choose which flows to keep and which to ignore.

All flows are processed but an alert is sent to the user.

Provide structure in the application model

Manually created

Can be expanded or collapsed

All of the above

A packet capture (pcap) file that is open on the local file system for analysis by Cascade Pilot.

A packet capture (pcap) file that is exported on to the Cascade Shark OS disk for analysis by Cascade Pilot.

A capture job that is suspended or stopped.

A time filter into a job trace.

1

2

3

4

5

Wireshark

AD Connector

SNMP Connector

Syslog Collector

1

2

3

4

Unlimited

User Defined Policies

SNMP Polling

Dashboards

Services

Navigate Network

The cold cache response time, when the information is first requested from the database.

The response time from the warm cache, known as the First Response table.

The response time measured from the start of the database query to the receipt of the first response packet.

The response time measured from the start of the database query to the receipt of the final response packet.

The response time for stored procedure queries into the database.

High Speed Capture, Transaction Analyzer

Packet Analyzer, Packet Download Manager

Packet Analyzer, High Speed Capture

Packet Analyzer, Transaction Analyzer

Database Performance mode

Application Stream Analysis boost mode

Server Boost mode

Web Transaction Analysis mode

Manually created hosts are not monitored

Manually created relationships are not monitored

Thresholds need to be set

All of the above

Time from 1st ACK to 1st DATA.

Time from (SYNACK to 1st DATA) – client delay.

Time from SYN to 1st DATA.

Time from SYN to 1st ACK.

GUI login UID/PW.

SSH login UID/PW.

GUI and SSH login UID/PW.

User name to IP mapping in reports.

XenApp

Any of them, but an agent on Citrix servers needs to be installed

NetScaler

XenDesktop

An Application is a collection of Host IP Addresses.

An Application is a Layer-7 protocol or combination of IP Address and Port.

An Application is a list of TCP Port Numbers.

An Application is a combination of several Host Group Types.

BGP

Windows Messenger

SMTP

IM

Skype

BPF filters

Pilot filters

WireShark display filters

Riverbed filters

Go to the Dashboard page and verify that the graphs display data.

Go to the System- > Information page and assure that all status indications (System and Component, DNS Server) are displaying OK.

Go to the System- > Devices/Interfaces page and assure that each data source that is expected to be available is listed and that no status indicators are red.

Go to the Reports- > Traffic page. Near the bottom of the Report Criteria section, click Run now. Verify that a traffic report is displayed.

All of the Above

Profiler does not support any RTT calculations

Network Round Trip Time, Average Server Delay, Packet Transaction Time

Server Delay, Network Round Trip Time, Server Response

Average Server Response, Average Network Round Trip Time, Average Server Delay

Average Network Round Trip Time, Average Server Delay, Average Transaction Time

Service Performance Report

Service Incident Report

Performance Investigation Reports

Event Reports

Service Level Objective Reports

NT 4.0

Windows Server 2003

Windows Server 2008

Windows Server 2005

A & D

TCP sessions are easily determined as completed through the existence of flags included; this isn’t true for UDP sessions

UDP sessions are easily determined as completed through the existence of flags included; this isn’t true for TCP sessions

Both TCP and UDP sessions are easily determined as completed through the existence of flags included

Neither TCP nor UDP sessions can be determined as completed unless 20 minutes has passed since the last packet is observed

MTU size changes can be used to determine that a session is complete for either TCP or UDP

Nothing; sFlow actually provides better data to Cascade since it is sampled packets and not just header data.

A loss of granularity as sFlow is sampled and doesn’t see every packet of a conversation.

Since Cascade takes the sampling rate of sFlow into account, nothing is lost.

sFlow should be configured to obtain granularity.

Host/Group

IP Address/Subnet

Interface/Device

Network

Cascade will send synthetic transactions to measure response time.

Cascade has a software agent that can be loaded on a Windows Server to provide response time metrics with most major applications

Cascade tracks Response Time metrics by observing live traffic. These metrics are used with other indicators to build baselines and analyze deviations that may be indicators to issues.

All the above.

It is a cost effective way of collecting IP conversation details from existing routers in the network

It is a packet capture technology that allows remote monitoring of packets in the network

It is a logging protocol for security events

It provides information about the number of bits and packets per protocol between each pair of IP Addresses across a device

It provides details such as response time and application level transactions across the network

Sensor; Compressed

Cascade Profiler; send in its original form

Cascade Express; sent de-duplicated

Cascade Express; sent in its original form

Cascade Gateway; sent in its original form

ByLocation

ByHostGroup

ByPortsAndApplications

ByFunction

ByTimeZone

Quickly analyze large capture files.

WiFi packet analysis.

Import data to NetProfiler.

Improve analysis speed.

Business Groups

Web Applications

Defined Applications

Server Applications

There is no difference between an Express and Standard Profiler.

An Express Profiler has the option only for a built-in Sensor and cannot receive flow data.

A Standard Profiler has the option only for a built-in Sensor and cannot receive flow data.

An Express Profiler can handle more flows per minute then a Standard Profiler.

An Express Profiler has a built in Sensor and Gateway.

Identity integration to identify which users are logged into which client machines.

Integration with synthetic transaction tools to obtain response time information.

A fully functional CLI that is easier to use than a Web based GUI.

A Web based GUI that does not require a password or HTTPS connection allowing for easier connection.

Behavior analytics for proactive monitoring.

Ability to automatically create Hostgroups and draw Network Topology, using Netflow.

Dependency mapping for an always-accurate view of your applications and their dependencies.

Cost-effective visibility into remote sites by leveraging SteelHead.

Ability for true, end-to-end coverage of the enterprise with dashboard-to-flow-to-packet analysis, providing scalability and flexibility.

Executive-level dashboards for a quick summary of service performance.

Syslog

SNMP

HTML

Facebook

PDF

Unlimited

1000

100

10

3

receive mail from others.

send reports.

send disk failure notifications.

send alerts.

When one host on the network attaches to a network printer-scanner device and is able to exploit the printer-scanner to download all material scanned on the device.

When one host on the network is infected with malware and the malware scans all of the files resident on the infected system looking for exploits.

When several hosts on the network send a high volume of traffic to a single host to try to exhaust the resources of the host.

When one host on the network send ping packets or other packet types to multiple other devices on the network to determine which hosts are available for further exploit.

Packets across all the ports of an appliance.

Packets on a single physical capture port.

Packets on an aggregating capture port.

Packets across different Cascade Shark appliances.

A time selection on a trace file.

A time selection on a Capture Job.

A selection of packets stored for a Capture Job.

A copy of packets stored for a Capture Job.

Many organizations do not know all the aspects of a given application or service they provide, which makes it difficult to fully map that service and monitor it from end to end. NetProfiler has visibility into many different areas and can often see connections used by different parts of a service that may be unknown to different administrators. This visibility allows NetProfiler to iden tify all the different components of a service and pro

When monitoring an application, it is often necessary to think of that application as a service instead of an application. By utilizing NetProfiler Services, you are able to take your application and easily convert it to a service. This conversion allows you to treat the application differently so it can be more effectively monitored.

Applications are large and complex and often traverse different groups within a single organization. Without the concept of a service in NetProfiler, it would not be possible to monitor the traffic from a single application since each group would have no purchase their own NetProfiler to monitor their individual aspect of the application.

None of the above.

By setting static thresholds for Application metrics and Interface metrics, tolerance can be determined. Cascade will use these thresholds and tolerances to report on deviations indicative of Performance problems.

The Customer only needs to identify their critical interfaces and applications, and Cascade will automatically baseline their behavior and report on deviations indicative of Performance problems.

The Performance Analytics are able to detect security threats such as host scans and worms.

After base-lining, Cascade can re-route congested traffic to avoid congested application delivery paths.

Service Health

Watched Traffic

WAN Utilization

Service Map

Security Threats

Response Time

Layer 4 Application Classification Mapping

Layer 7 Application Classification Mapping

Network Throughput

Network Round Trip Time

No additional value, deployed only as a necessity when NetFlow is not available.

The Sensor adds synthetic transactions to track response time.

The Sensor adds trace-route capability to map out Application paths.

The Sensor adds Application identification and Response time metrics for TCP sessions.

MAC address of the host

IP address of the host

Port number

IP protocol

Application name

User name

You must run only a single version of the AD connector program.

Install the AD Connector 1.5 on all domain controllers.

Install the appropriate version of the AD Connector on each domain controller.

Install the AD Connector v2.0 on all domain controllers.

Install the AD Connector v2.0 on an Event Collector host.