299-01 Riverbed Certified Solutions Professional - Network Performance Management Questions and Answers

Unlimited

Ten

Four

Twenty

Is either a BPF or Wireshark Display filter only.

Can be created from a chart.

Can be changed after applying a View.

Is the equivalent of the Wireshark " display filter input " .

They all point to the same NTP server.

The Profiler, ideally, points to an NTP server (although it can use local time as well), the Gateway and Sensor get their time information from the Profiler which acts as their NTP Server.

For security reasons, all components use local time. The same time should be set on each component.

They all synchronize their time via timestamps in Netflow sources.

Network Round Trip measurement

Packet logging

Server Delay measurement

Connection Throughput measurement

Retransmission measurement

L7 application fingerprint checking

echo " delete from hostinfo where ipaddr = ' 10.63.32.0/24 ' ; " | psql mazu postgres

Edit the Definition and remove the entry for 10.63.32.0/24 Bracknell_UK

echo " delete from hostinfo where group = ' Bracknell_UK; " | psql mazu postgres write_community_string

Go to Host Groups and insert " #10.63.32.0/24 Bracknell_UK "

Cascade Profiler can use switch port discovery to retrieve ARP and CAM tables directly from the NMS.

Most NMS ' can be configured to SNMP Poll Cascade Profiler to retrieve conversation information.

Network API (from NMS via URL strings to get Cascade Reports)

There are no integrations; NMS ' are competitors to Cascade Profiler.

External Links (from Cascade Profiler via URL strings to NMS)

2000

4000

20000

40000

200000

400000

Client Ports

Applications

Ports

Server

Cache the most recent 500 IPs.

Obey DNS TTLs.

Cascade does not cache DNS responses.

For 24 hours.

One minute flow records are deleted from the file system FIFO (oldest first) once the appliance has filled the space that is allocated.

There is a fixed amount of space on the filesystem for completed reports.

A report template can be marked " keep until I delete it " so that any reports that are scheduled with this template are not automatically deleted from the filesystem.

When the flows or rollup records have been deleted from the filesystem, any saved report that was generated from those flow sources is no longer available.

Users have the ability to allocate additional space to the 1 min flow logs in order to increase retention. This is done at the expense of other rollup resolutions.

Longest Match

Shortest Match

IP & Port

IP

At least one NetFlow sources (router, switch, or steelhead).

At least one lookup router and at least one access tier switch.

A Vulnerability Scanner and a Netflow source (router, switch, or steelhead).

A Vulnerability Scanner and an External Link.

192.168.1.120 is not in the 192.168.1.0/25 subnet

192.168.1.120 has been input as a trusted host in a security policy

Traffic to 192.168.1.120 was not picked up by a Sensor

Traffic to 192.168.1.120 was not picked up by a Gateway

192.168.1.120 never sent any traffic

Select two views from the views panel using control-click then right click on one and select " Create Interactive View " from the drop-down menu.

After a Drill-Down from one view to another, right click on the Drill-Down view in the sources panel and select " Create Interactive View " from the drop-down menu.

Select any item (such as a host IP Address, Port or Protocol name) in the main workspace and right click on the item, then select " Create Interactive View " from the drop-down menu.

Select any view in the views panel, right-click it and select " Create Interactive View " from the drop-down menu.

Open the filters panel, apply an existing or new filter to the view then select " save as interactive view " from the home menu.

1

2

3

4

Unlimited

Line Graphs

Stacked Area Graphs

Pie Charts

Bar charts

Connection Graphs

Tables

You have to manually configure the interface speeds on the Devices/Interfaces page.

You have to configure SNMP access to the reporting devices on the Devices/Interfaces page.

One of either A or B above.

None of the above; Cascade will figure this out automatically.

You can connect directly to the Cascade Shark with Cascade Pilot to begin analysis.

You can connect directly to the Cascade Shark with Cascade Gateway to begin analysis.

You can start analysis on the Cascade Profiler based upon flow data that has been sent from Cascade Shark to Cascade Profiler.

You can export data from a capture job directly to a packet capture (pcap) file and open in any tool that accepts pcap format.

You can start by loading views of the data from the Cascade Shark Appliance Web GUI before export to Wireshark.

40

65

17

55

425

End time of Flow

Source MAC address

Layer 4 Protocol Type

TCP Checksum Validation Result

Layer-7 Application Fingerprinting

Connection Duration Statistics

Riverbed RiOS Integration

Rotating Packet Log

Traffic between Virtual machines is not switched; it is routed by the standard vRouter included with ESXi

A standard or distributed vSwitch which comes with ESXi must be used, there is not 3rd party software available

A 3rd party virtual switch is required such as the CISCO Nexus 1000v as no standard vSwitch exists with ESXi

The included standard vSwitch of the CISCO Nexus 7000

The included standard vSwitch or the CISCO Nexus 1000v

An Email Address only

An SNMP receiver only

An SNMP receiver only tied to a set of Host Groups

An Email Address and/or one or two SNMP receivers optionally tied to a set of Host Groups

An Email Address and/or one or two SNMP receivers optionally tied to a set of User Accounts

A User Account

Unconditionally overwrite any existing layer 7 application mapping.

Apply to flows that are either Unclassified, or did not match any known layer 7 signatures

Apply only to flows that are not seen by a Cascade Sensor or other layer 7 signature-based device.

None of the above.

You must have at least three days of history of 15 minute rollups before saving the analytic.

You must have at least three days of history of 15 minute rollups before the analytic initializes.

If you include all possible metrics, but there is no possibility of measuring response time due to lack of Sensor coverage, the analytic will fail to initialize.

The analytic will not alert for a minimum of 1 week during baseline collection.

Both B and C.

If the Layer 4 mapping override policy is not " Unknown/Unclassified " , the Layer 4 mapping applies to flows not passing a Sensor or other application fingerprinting device as well as to flows not matching any defined Layer 7 fingerprint

If the Layer 4 mapping override policy is " Always " , then the Layer 7 fingerprint will never be used for flows matching both criteria

If the Layer 4 mapping override policy is " Unclassified " , the Layer 4 mapping only applies to flows not passing a Sensor or other application fingerprinting device

If the Layer 4 mapping override policy is " Unknown/Unclassified " , the Layer 4 mapping applies to flows not passing a Sensor or other application fingerprinting device as well as to flows not matching any defined Layer 7 fingerprint

Care must be taken when defining reports and policies to reflect overlapping definitions and the Layer 4 override policy

The traffic Expression " app L7_fingerprint or app L4_mapping " will catch all traffic flows for the application data in a report

Increase in Server Delay

Decrease in Average Connection Application-level Throughput

Increases in the number of TCP retransmissions

Decreases in the number of new connections to the application servers

Increase in the number of Active Connections

Switch Port Discovery Protocol (SPDP)

Merging of CAM + ARP tables, both gathered via SNMP

Merging of IF and ARP tables, both gathered via SNMP

Merging of IF and CAM tables, both gathered via SNMP

11 for the Cascade Profiler, 3 Cascade Gateways

10 for the Cascade Profiler, 3 Cascade Gateways

11 for the Cascade Profiler, 5 Cascade Gateways

10 for the Cascade Profiler, 5 Cascade Gateways

12 for the Cascade Profiler, 4 Cascade Gateways

A Host Group Type is a container that may contain multiple Host Groups.

A Host Group Type defines the name of the Host Group.

They are the same thing.

Each Host Group must be defined by the Type of application it serves; this is the Host Group Type.

When the traffic flow matches more than one Application signature. This indicates that the one Application may have been tunneled over the other.

When an Application runs over a non-standard port (such as TELNET traffic on Port 80).

When a " port definition " is non-standard (e.g. when you change tcp/80 ' s definition from http to telnet).

When a Layer-4 Application Mapping is defined.

Three weeks

Three days

One day

Configurable from one minute to three weeks

All Service-based application performance policies

All Service-based policies plus all Performance and Availability analytic policies

All Service-based policies plus all Performance and Availability analytic policies plus all User-Defined Policies

All Service-based policies plus all Performance and Availability analytic policies plus all User-Defined Policies plus all Security policies

None of the above

By listing lost packets in the expert window

By using dotted-dashed lines for out-of-sequence segments

By placing error names on the messages within the diagram

By color-coding the messages on the diagram

By using a thicker line for messages that include errors

Traffic is being sent across the router ' s interfaces configured for flow export.

There are no firewalls blocking communication between router and Cascade Gateway.

There are no firewalls blocking communication between Cascade Gateway and Cascade Profiler.

The port being used for export on the router matches that which has been configured on the Cascade Gateway.

All of the above.

A service segment is the update time period when devices send Netflow to Cascade Gateways.

A service segment is defined by its components and the applications and/or ports in use between them.

A service segment is defined as the front-end tier that directly services end users with an application.

A service segment is the update time period when Cascade Sensors send MNMP Flow to Cascade Profilers.

Event Manager

Dispatcher

User Interface

Database

Any dependency (connection graph) can be exported to SVG (Visio) format.

Reports are real time and can not be scheduled.

Reports can be sent via PDF, HTML, CSV, or DOC format.

Events can be sent via email or SNMP v1 or v3 traps.

Events can be sent to both an email list AND SNMP target.

obtain MAC addresses.

improve accuracy of the security baseline.

force lease extensions longer to make tracking unique PCs easier.

obtain an IP for itself.

Application Sensor

Gateway

Profiler

All of the above

None of the above

It obtains L2 retransmissions from switches and routers via SNMP.

It obtains TCP retransmissions by tracking TCP sessions via the Cascade Sensor.

Cascade does not track retransmissions.

Cascade obtains retransmissions from NetFlow and/or sFlow marked with the TCP push flag.

The flows that are being viewed in Cascade Profiler must be reported by a Shark appliance.

The user ' s workstation requires a licensed copy of Cascade Pilot.

The user ' s workstation requires access to the Cascade Shark appliance on the appropriate TCP Port.

If there are multiple capture jobs configured on the Cascade Shark appliance, the user must select which one to apply the trace clip against.

All of the above.

No, because a link analytic can monitor only a single interface.

Yes, one can define separate link congestion analytic policies for each WAN interface.

No, because one can only define specific ports to include on a link congestion policy.

Yes, because one can define a port group that includes every UDP and TCP port except for those that include the expected traffic, and that port group can be used for the link congestion analytic policy.

No, and both A and C include valid reasons.

Packets can be captured from multiple capture ports on one Cascade Shark appliance.

The maximum length the packet data can be specified.

Packets can be filtered on host IP addresses.

SSL traffic can be decoded if the appropriate certificate are loaded in the Cascade Shark appliance.

The maximum storage bandwidth for the job can be specified in bits/sec.

Multiple packet capture jobs can run concurrently.

HTTP Object load times can be analyzed with full packet capture

SSL Decryption can be used without any special key imports provided the start of the TCP conversation is captured

Software Agents are required on Servers in order to measure the Network Round trip time of applications

ICMP (ping echo/response) must be used in order to measure Network Round Trip time

NetFlow records can be summarized to provide utilization on a router interface

Set the disk space for that data resolution to 0 in Configuration > Flow Log.

Set the disk space for that data resolution to -1 in Configuration > Flow Log.

Set the disk space for that data resolution to -1 in Configuration > General Settings.

Set the disk space for that data resolution to 0 in Configuration > General Settings.

Select a Capture Job, right-click, and select " Create Trace Clip " .

Drag a bar from a Bar Chart to the Capture Job.

Click the + button in the Capture Job item and select a time window.

Select a time window and apply a Cascade Pilot filter.

WAN Dashboard

Application Dashboard

Devices/Interfaces View

Network Operations Dashboard

Network Security Dashboard

Host Scan

Port Scan

Link Availability

Suspicious Connection

There is no event that triggers before a worm event.

The license key is entered during installation. The license is activated either through an Internet connection or by phone.

The license key is entered during installation. The license must be activated through an Internet connection.

The license key is entered during installation. There is no activation but Cascade Pilot will detect if the license is already in use on the network.

There is no license key activation. The software image is shipped with the license key installed.

Host Groups must be configured.

Cascade Profiler must be successfully polling Steelhead appliances via SNMP.

The WAN-Steelhead interface group must be populated with WAN interfaces for all Steelhead appliances.

The Profiler baseline collection must be complete.

A WAN Optimization reporting template must be configured.

Host Baseline Profiles

Custom Port Definitions

Host Groupings

Mitigation Configuration

Firewall Configuration

A BPF packet filter

A disk space allocation

Time-based display resolution

Trend/Indexing parameters

Access credential information

10.0.0.0/255.255.255.255

0.0.0.1/255.0.0.0

10.0.0.1/255.255.0.255

10.0.0.0/255.0.255.0

10.0.0.1/255.0.0.255

From packets via the Cascade Sensor or Shark

From NetFlow and other standard flow protocols

From IP SLAs on any network-attached device

From CDP

From NBAR

If the Steelhead is running a RioS version older than 5.5.3, the Steelhead WAN interfaces need to be manually added, and marked as Steelhead interfaces.

If the Steelhead is running a RioS version 5.5.3 or higher, the Steelhead WAN interfaces are automatically added to the WAN page, but the user must manually mark them as Steelhead interfaces.

If the Steelhead is running a RioS version 6.0.1 or higher, the Steelhead WAN interfaces are automatically added to the WAN page and are also be marked as a Steelhead interface.

All of the above are true.

A and C only are true.

On the Sensor, you must define either a hex string, text string, or URL.

On the Profiler, you must define either a hex string, text string, or URL.

On the Gateway, you must define either a hex string, text string, or URL.

You have to first enable security analytics on the Profiler, then you define either a string or URL on either the Profiler or the Sensor.

Custom applications cannot be defined, but the Sensor can identify most off-the-shelf programs.

Determines the lowest value that can be used to create a service mapping for one application segment.

Specifies the minimum real value (fixed threshold) that will trigger an alert.

Sets the highest value that can be used to create a service mapping for one application segment.

Specifies the minimum amount of change that the policy can treat as a deviation from normal behavior when creating an Analytic.

192.168.0.100/255.255.0.255 Philadelphia

192/8 Baltimore

172.168.1.1 Phoenix

10/16 Chicago

Guarantees that the ifIndex values for various interfaces remain stable across Steelhead appliance reboots and reconfiguration.

Guarantees that the ifIndex values for various interfaces remain stable across network disruptions preventing re-polling

Guarantees that the ifdescription values for various interfaces remain correctly mapped across Steelhead appliance reboots and reconfiguration.

Guarantees that the ifdescription values for various interfaces are remapped across Steelhead appliance service shutdowns.

Enabled

Disabled

Set to retain up to 1 week or 10GB of indexing/trending data

Set to retain up to 1 week or 10GB of packets

Set to keep the indexing/trending data indefinitely

Perl Regex

Cascade Pilot Filter

Wireshark Capture Filter (BPF)

Wireshark Display Filter

Time Interval

Visual Basic

You must consider how many capture cards are required.

You must consider how much disk space is required.

You must consider the write-to-disk speed required.

You must consider how many Cascade Pilot consoles will be connecting.

You must consider how many Cascade Profilers the appliance will export to.

The trace clip is likely smaller in size, so views load faster.

The trace clip is moved to the local system, so views load faster.

The trace clip has a base set of views pre-applied, so analysis is faster.

The trace clip is guaranteed to have trend/index data, so views load faster.

Applications, Ports/Protocols, QOS, Servers, Clients

Ports/Protocols, QOS, Servers, Clients

Applications, Ports/Protocols,

Applications, Ports/Protocols, QOS, Servers, Clients, Interfaces

Stratified policy limits ranging from 5000 for Cascade Profiler Express platforms to 10,000 for Cascade Enterprise Profiler platforms

5,000 for all platforms

15,000 for all platforms

The Analytics license provides for an unlimited number of policies

None of the above

Copy the file onto a Cascade Shark to ensure better performance.

Create an index so that processing of the View analytics will be faster.

Apply a View with a specific filter.

Use Wireshark tools to split the trace file in multiple and smaller trace files.

Apply a View on the live interface and then start a Capture Job on the capture port to analyze traffic later.

Start a Capture Job on the capture port with a BPF filter and apply a View on the live interface for the same capture job.

Start a Capture Job on the capture port, apply a View on the live interface and create a trace clip for the time window of interest.

Never create a Capture Job to prevent packet drops.

Creating or modifying custom host groups.

Grant other users the ability to run user reports.

Set or modify passwords for other users.

View the audit trail page.

Specify mitigation actions.

Watched list as a bar chart

Watched list as a stacked area chart

Watched list as a line graph

Watched list as a pie chart

Top list as a bar chart