Hybrid-Cloud-Observability-Network-Monitoring Hybrid Cloud Observability Network Monitoring Exam Questions and Answers

In SolarWinds Universal Device Poller (UDP), the column get type is used to retrieve values from a particular column of an SNMP table, meaning you get all the values for that column across multiple rows.

You can check the status of the flow collector service from the NetFlow collector services section and from NetFlow settings in the SolarWinds web console. These locations provide service health, up/down status, and logs. " Flow and CBQoS sources " and " Top XX receivers " do not display service health.

Unreadable fields in SNMP traps from a device typically indicate either the device is not monitored as a node (so SolarWinds cannot fully parse its SNMP data) or the MIB file for that device is not included in the SolarWinds MIB database, making it impossible to decode certain OIDs.

Device Studio supports advanced custom polling, allowing you to build pollers for technologies such as multi-CPU/memory, node details (e.g., chassis, serial number), and single CPU/memory. While interface traffic polling is best accomplished through standard interface resources, Device Studio is designed for more advanced or complex device metrics that are not available via built-in polling.

To request an update to the SolarWinds MIB database, you must provide a complete SNMP walk or MIB walk from the device in question. This allows SolarWinds to identify and incorporate new OIDs and their definitions into the database.

From the documentation:

" Submit a request with a full SNMP walk or MIB walk output from your device. This provides the necessary OID and device structure for the SolarWinds team to update the MIB database. "

SolarWinds provides the flow alert wizard as the tool to configure and manage flow alerts. This wizard guides administrators through selecting the relevant flow metrics and alert thresholds.

The documentation states:

" Use the Flow Alert Wizard to define and manage alerts on flow-based data, allowing for rapid detection and notification of anomalous network activity. "

When you observe an " unknown traffic event " in the SolarWinds web console, it usually means the collector is receiving NetFlow or other flow data from a device that is not currently managed or monitored in the SolarWinds database. The collector can receive flows from any device, but if the device is not added or properly monitored, the traffic will show up as " unknown " because SolarWinds cannot associate the flows with a known interface or device.

When the SolarWinds Log Analyzer web console is in " live mode, " it automatically refreshes the log viewer data every 10 seconds by default, ensuring users see near real-time event streams.

The documentation states:

" In live mode, Log Analyzer refreshes data every 10 seconds to display the most recent events as they arrive. "

The Universal Device Poller (UnDP) allows administrators to define custom SNMP OIDs for statistics (like UPS battery status) that are not natively polled. You can assign a new UnDP to an existing node to monitor additional values such as UPS battery status, provided the device supports the necessary OID.

When displaying Universal Device Poller (UDP) data in different web console views, each view must be configured to show the UDP results as charts.

From the documentation:

“In the Universal Device Poller application, under the Web Display tab, you must check the ‘chart’ box for every web view where you want to display the poller data. If the box is not checked for the current view, the data will not be visible as a chart widget.”

When a node status is “unknown,” it often means the SolarWinds platform cannot communicate with the node. The first checks should be:

Ping response: Verify if the node is reachable via ICMP ping, as lack of response leads to an unknown status.

Polling method: Confirm the correct polling method (ICMP, SNMP, WMI, API) is configured and functioning.

OID (A) is related to SNMP but not directly to basic node status, and view method (D) is not a relevant diagnostic step.

When the NetFlow collector service is showing a " down " status, the SolarWinds documentation recommends the following troubleshooting steps:

Confirm the database connection is up and server has free resources.

Explanation: The NetFlow collector service relies on connectivity to the SolarWinds database. If the database connection is lost or the server is out of resources (such as CPU or RAM), the service may go down or fail to start. Ensuring that the database is reachable and that the server has enough resources is a primary troubleshooting step.

Start or restart SolarWinds’ NetFlow service from Orion Service Manager.

Explanation: The official troubleshooting guidance instructs administrators to use the Orion Service Manager to start or restart the NetFlow service. This is a direct method to recover the NetFlow collector from a " down " state and is one of the first actions recommended by SolarWinds support.

Options B and C are not recommended in the official documentation:

Deleting and re-adding the NetFlow collector service is not a documented troubleshooting step and may cause loss of configuration.

Starting or restarting the generic " collector service " is not specific to NetFlow; the correct service is the NetFlow service.

Exact Extract from Official Guide:

" If NetFlow collector service status is down:

Ensure the SolarWinds database is online and the server is not experiencing resource issues.

Use the Orion Service Manager to start or restart the NetFlow service.

If the issue persists, review the NetFlow logs for errors and consult the SolarWinds Success Center for advanced troubleshooting. " — (Network Performance Monitor Administrator Guide, Troubleshooting NetFlow and Service Issues)

The local NetFlow source provides live (real-time) flow traffic data that is sourced to and from the main polling engine server. This feature is primarily for monitoring the main polling engine’s traffic and quickly identifying top talkers and general flow activity on that server.

The correct process for creating a poller in Device Studio is:

Select the technology

Specify the data source

Assign the poller to a node

Save the poller

SolarWinds Log Analyzer and Hybrid Cloud Observability support log collection from current, supported Windows operating systems, such as Windows 10 (workstation) and Windows Server 2019. Older or unsupported versions like Windows Vista or Server 2012 may not be supported.

To monitor an application on a server with SolarWinds, you must first find the application in the list of available (supported or discovered) applications and enable monitoring for it. The platform also provides a “monitor recommended applications” button to automatically suggest and enable monitoring for best-practice applications on a given server.

From the documentation:

“To monitor an application, select it from the list of available applications and enable it for the target server. The ‘Monitor Recommended Applications’ option helps you quickly enable commonly used application monitors.”

Grouping IP addresses or configuring specific source/destination pairs is not required for standard application monitoring.

To detect duplex mismatches:

The node must be monitored (i.e., managed in SolarWinds).

The node must be in " up " status, so SNMP data about interface status, speed, and errors can be polled and compared.

Description in MIB (A) is not necessary if the device is already SNMP-capable, and " warning " status (C) is a result, not a requirement.

For organizations with very large environments and strict requirements for data freshness and availability, SolarWinds documentation prescribes several specific steps:

A. Deploy multiple additional polling engines (APEs) in each regional datacenter and configure load balancing. " For environments exceeding 20,000 monitored interfaces, deploy multiple Additional Polling Engines (APEs) to distribute load and maintain polling intervals. Place APEs close to monitored devices to reduce latency. "

B. Implement SolarWinds High Availability (HA) pools for both the main and polling engine servers, with active-passive failover. " SolarWinds HA pools provide automatic failover for platform and polling engines, ensuring service continuity in case of hardware or network failures. "

C. Configure the SolarWinds database server in a Microsoft SQL Server Always On Availability Group. " To protect against database outages, deploy the SolarWinds database in a SQL Server Always On Availability Group or Failover Cluster Instance (FCI). "

Option D is incorrect; overlapping node groups are not a requirement and, in fact, the documentation suggests using dynamic assignment to balance load, not strictly static node groups.

In NetFlow (especially Flexible NetFlow on Cisco devices), a flow monitor is applied to an interface to track and collect information about IPv4 (or IPv6) traffic. The flow monitor references a flow record and a flow exporter. The monitor itself is the entity configured on an interface to start the flow tracking process.

Device Studio is designed to enable support for complex devices and can poll multiple OIDs as part of a single custom poller definition. While Universal Device Poller (UDP) is also used for custom SNMP polling, it is generally limited to a single OID per poller. Device Studio is intended for use cases that require combining and correlating multiple OIDs for richer, template-based device monitoring.

To monitor and configure High Availability (HA) mode for site-to-site VPN tunnels on a Cisco ASA firewall, SolarWinds uses SNMP for standard device and interface metrics, and CLI polling for advanced VPN and HA state details. SNMP provides general health data, while CLI polling (using Device Studio or Network Insight) collects information not available via SNMP, such as detailed VPN and HA status.

When you create a flow alert in SolarWinds, the object of the alert (such as a specific interface, node, or application) is chosen from the “Create a Flow Alert” panel. Flow alerts are not based on custom SQL queries, require the NetFlow service to be running, and always have associated trigger actions.

Applications and NBAR2 applications in top applications are sorted by bytes: The default sorting for the “Top Applications” view, including NBAR2 apps, is by bytes.

It is possible to combine applications and NBAR2 applications: SolarWinds allows combining standard and NBAR2-classified apps for alerting and reporting purposes.

Exact Extract from Official Guide:

" Top Applications, including NBAR2, are sorted by bytes and you can combine standard and NBAR2 application data in alerts and reports. "

— (Network Performance Monitor Administrator Guide, “NBAR2 Applications” section)

The correct polling method is Agent. SolarWinds documentation explains that agents are useful when traditional polling methods such as WMI or SNMP are difficult because of firewall, NAT, proxy, or domain boundary constraints. For Windows systems, WMI can require multiple ports, including RPC/DCOM-related ports, which makes firewall configuration more complex. SolarWinds agents provide a communication channel between the SolarWinds Platform server and the monitored computer and can perform secure polling over a single port. API and CLI are not the native replacement polling method for this Windows device scenario, and SNMP would not solve the Windows native polling/firewall problem in the same way.

===============

To monitor a custom application using flow monitoring in SolarWinds Hybrid Cloud Observability, you must define the application by specifying its port or port range (and optionally protocol). After this, the application can be assigned to flows involving specific machines, but the primary step is to define application ports first.

To create a NetPath probe in SolarWinds, you need to specify a source (which requires a Windows-based agent or node) and a destination port. The documentation states:

“To deploy a NetPath probe, select a Windows node or agent as the source and specify the connection port for the service to be monitored. Linux nodes and agents are not supported for NetPath probes.”

For a node-specific log view, navigate to the node’s details summary and choose “Analyze Logs” under the Management section. This provides a filtered view of log messages for the selected node, allowing you to drill into relevant log events and details.

From the documentation:

“To view logs for a specific node, open Node Details > Management > Analyze Logs for node-level log analysis and troubleshooting.”

Resource is showing outdated information: If polling intervals are too long or if there is a communication problem, the hardware health resource may not update promptly, resulting in inaccurate status display.

Wrong MIB being used for polling: If SolarWinds is using an incorrect or generic MIB, it may not retrieve accurate hardware health data for the specific fan sensor, causing the status to incorrectly display as “up” even when failed.

While disabled sensors and forced thresholds may impact alerting or monitoring, they are less likely to cause this direct display inconsistency.

SolarWinds Hybrid Cloud Observability supports a wide range of flow technologies for IP traffic monitoring. Per the SolarWinds NPM Administrator Guide:

" SolarWinds supports NetFlow, sFlow, J-Flow, and IPFIX for monitoring traffic flows. These protocols are used by devices from different vendors to export flow information. "

J-Flow: Used by Juniper devices and fully supported.

NetFlow (nFlow): The industry standard from Cisco and widely supported.

sFlow: A vendor-neutral flow technology supported by multiple devices.

IPF1X is not a recognized flow protocol in SolarWinds documentation.

Duplicate flow data typically results when both ingress and egress flow monitoring are applied simultaneously on interfaces. If both directions are enabled either globally (all interfaces) or locally (on a single interface), the same flow is counted twice—once entering and once leaving—resulting in duplicate statistics.

Accuracy is decreased: By increasing the polling interval, you reduce the frequency of path checks, which can cause the data to be less granular and less timely, reducing overall accuracy.

Probe is more likely to show all routes: With a longer interval, transient or temporary routes are less likely to be missed, and NetPath might display more complete route information over time.

The probe will still complete successfully; it is just executed less frequently. Accuracy is not increased with a higher polling interval.

To change the polling interval for a specific node, navigate to the Node Details Summary, then choose “Edit Node.” In the polling section, you can configure how often SolarWinds polls this node for status and statistics. This is the correct place for per-node polling interval adjustments.

The global polling settings under “Settings > All Settings > Polling Settings” (option D) affect all nodes, not an individual node.

Show best is the status rollup mode designed for groups of redundant or backup devices. It displays the " best " (most available/least severe) status within the group, which is most useful when any one device in the group being up means the group is healthy.

With Network Insight features (including for Palo Alto and F5 BIG-IP devices) installed alongside Network Configuration Manager and Performance Monitoring, you can monitor:

High availability details: Provides information on device redundancy, failover status, and clustering.

Policy details: Enables insight into firewall, security, and NAT policies for managed devices.

Access lists and VPNs may be monitored in other modules, but the primary, advanced insight is for high availability and policy configurations.

If the flow source view in SolarWinds NTA shows “never received” and firewall issues are ruled out, it is often because the device (node) is no longer monitored by SolarWinds. If a node is removed or its monitoring is disabled, the collector will not associate incoming flows from that node, resulting in " never received " status.

If interfaces on a node show an “unknown” status, the recommended solution is to delete and rediscover the node. This ensures all current interface information, OIDs, and properties are correctly detected and polled, resolving mismatch or missing data that can cause an “unknown” status.

To receive and process flow data, SolarWinds NTA/HCO must have flow sources enabled and must listen on the correct flow collection port. SolarWinds states that flow-enabled nodes and interfaces must be monitored before they can be recognized as flow sources in NTA, so monitoring the relevant interfaces under flow sources is required. SolarWinds also documents UDP port 2055 as the default port for receiving flows on an NTA collector. Port 1434 is related to SQL Server Browser/dynamic SQL discovery scenarios, not NetFlow collection. Adding nodes directly to “NetFlow endpoints” is not the correct SolarWinds configuration model; devices and interfaces are monitored and then enabled as flow sources.

===============

SolarWinds capacity forecasting accuracy improves when:

More historical data is used: The more historical data points included in calculations, the better the forecasting model will perform.

Using average daily values for calculations: This smooths out anomalies and provides a more accurate trend, as recommended in the documentation:

“To improve the precision of capacity forecasting, use as much historical data as possible and set calculations to use average daily values.”

Monitoring with platform agents or adjusting thresholds affects alerting, not trend accuracy.

To edit trigger conditions for flow alerts in SolarWinds, the SolarWinds Query Language (SWQL) is required. SWQL is a proprietary subset of SQL designed specifically for the SolarWinds Orion Platform. The documentation specifies:

“Editing advanced alert trigger conditions and custom queries for flow-based alerts requires the use of SWQL, not PowerShell, Python, or standard SQL.”

The SolarWinds MIB database is used for SNMP-based monitoring and performs these critical functions:

A. It defines which OIDs are recognized and what metrics can be polled via Universal Device Pollers or other custom monitors.

C. It maps OIDs (numeric identifiers) to their human-readable textual names for reporting and alerting.

Options B and D are not accurate; the database does not enable automatic polling nor does it update device OIDs during polling.

Resolving and storing hostnames at the time a flow record is received means the platform does not need to resolve the hostname each time a report or widget is loaded, which:

Decreases database query times: Hostnames are already resolved, making queries for reports and dashboards much faster.

Flow views and widgets load faster: With DNS already resolved, the interface does not have to perform on-demand DNS lookups, reducing latency in the web console.

The SolarWinds documentation states:

" Immediate DNS resolution upon flow record ingestion reduces lookup delays during analysis and widget loading, resulting in improved performance and reduced query times. "

Domain widgets and reports run with DNS names, but the core advantage is performance rather than widget availability.

A. MIB files define the available SNMP objects and metrics that can be polled from a device.

C. MIB files provide human-readable names and descriptions for OIDs, allowing SolarWinds to display metrics in a clear, user-friendly format instead of raw OID numbers.

Automatic device discovery is handled by network scanning, not by MIB files, and OIDs are created by device vendors, not by SolarWinds.

The best practices for creating a Universal Device Poller (UDP) in SolarWinds are:

Consult vendor documentation for OID: Always check the device/vendor documentation for the correct OID to monitor the desired metric.

Perform SNMPwalk to determine if OID exists: Use SNMPwalk to verify the OID’s existence and see if it is supported and returns the correct values from the device.

Calling SolarWinds support is not a standard step for obtaining OIDs, and WBemtest is a Windows tool for WMI, not SNMP/OID polling.

Exact Extract from Official Guide:

“Consult device vendor documentation for correct OIDs and perform SNMPwalk to ensure the OID exists and is supported by the device before creating a UDP.”

— (Network Performance Monitor Administrator Guide, “Best Practices for Universal Device Pollers” section)

Device Studio supports the following data sources:

Calculated result from transformation of polled values: You can apply calculations (such as average, sum, transformation) to the raw polled data.

Polled value by a device on an object ID: Device Studio can directly poll an OID from a device and use its value for monitoring.

Night/day standard deviation and predicted/baseline values are not direct data sources in Device Studio.

The radial gauge display in the SolarWinds web console requires that the polled value from the OID is a numeric type that supports gauge visualizations (for example, a percentage or value with a defined minimum and maximum). If the OID returns data that does not fit these requirements—such as text, status, or a counter with no clear min/max—the gauge option will be grayed out and unavailable for selection. This behavior is explained in the Universal Device Poller documentation, which states that only compatible numeric OID types can be displayed using radial gauge resources.

The Universal Device Poller (UDP) in SolarWinds NPM allows users to monitor any SNMP-exposed value, including interface traffic, UPS battery status, and CPU temperature, provided the device ' s MIB exposes the relevant OIDs. Users configure the UDP to poll these custom OIDs, making it a flexible option for monitoring a wide range of metrics across diverse devices.