299-01 Riverbed Certified Solutions Professional - Network Performance Management Questions and Answers

tcp/8443

udp/123

tcp/41017

tcp/42999

tcp/123

Layer 7 fingerprint matches always take priority over Layer 4 matches.

Layer 4 mappings with a higher priority number take precedence over Layer 4 mappings with a lower priority number.

Layer 4 mappings always take priority over Layer 7 fingerprint matches when the override is set to Unknown/Unclassified.

Layer 4 mappings with a lower priority number take precedence over Layer 4 mappings with a higher priority number when the override is set to Always.

C & D.

A, B & C.

Through Radius Server(s)

From Domain Controller(s)

Through LDAP queries

Via SNMP queries

Edit each Service policy to increase the Tolerance slider for Low and High alerts.

Edit each Service policy and set a noise floor to specify the minimum amount of change that the policy can treat as deviation from normal behavior.

Edit the Service and select fewer metrics to monitor for each segment that comprises the Service.

Modify the location host group type used for monitoring end user traffic to use fewer groups (for example, Region instead of Site).

A, B, C, and D.

A and B only.

Nessus

Rapid7

Qualys

Retina

nCircle

MBSA

11 for the Cascade Profiler, 3 Cascade Gateways

10 for the Cascade Profiler, 3 Cascade Gateways

11 for the Cascade Profiler, 5 Cascade Gateways

10 for the Cascade Profiler, 5 Cascade Gateways

12 for the Cascade Profiler, 4 Cascade Gateways

Definitions->Host Groups

Definitions->Applications

Definitions->Port Names

Definitions->Port Groups

Integration->Switch Port Discovery

Average drops

Average retransmits

Average response time

Average utilization

Total bandwidth bits

Is either a BPF or Wireshark Display filter only.

Can be created from a chart.

Can be changed after applying a View.

Is the equivalent of the Wireshark "display filter input".

Host Groups must be configured.

Cascade Profiler must be successfully polling Steelhead appliances via SNMP.

The WAN-Steelhead interface group must be populated with WAN interfaces for all Steelhead appliances.

The Profiler baseline collection must be complete.

A WAN Optimization reporting template must be configured.

Layer-7 Application Fingerprinting

Connection Duration Statistics

Riverbed RiOS Integration

Rotating Packet Log

Any traffic using application "X" or port range "Y"

Any internal-only traffic using application "X" or port range "Y"

Any internal-only traffic using application "X" and port range "Y"

Any traffic between internal and external hosts using application "X" or port range "Y"

Any traffic between internal and external hosts using application "X" and port range "Y"

Any traffic from internal clients to external servers using application "X" or port range "Y"

Any traffic from internal clients to external servers using application "X" and port range "Y"

Application Sensor

Gateway

Profiler

All of the above

None of the above

Data Component

Segments

Report Criteria

Router

User(s)

Cascade is sized based upon the number of sources that will be sending NetFlow to a Gateway, and the number of Gateway's sending data to a Profiler. Each Gateway is sized to handle a certain number of sources, and each Profiler a certain number of Sensors and Gateways.

Cascade is sized by the packet volume across the environment. Each Sensor and Gateway component can handle a certain packet rate.

The primary measures are flow-rate and topology. Flow-rate drives the size of the solution; topology can determine the placement of Sensors. As a secondary sizing method we can use host count and rule-of-thumb host/flows ratio to estimate the flow-rate.

Cascade is sized purely based upon the number of Servers being monitored in the environment.

Changes are saved only in the View to which the filter has been applied.

The modified filter is saved on the machine on which Cascade Pilot is running.

The modified filter is saved on any Cascade Shark that Cascade Pilot is connected to.

The changes are lost when you close Cascade Pilot.

By setting intelligent static thresholds for Application metrics and Interface metrics, tolerance can be determined. Cascade will use these thresholds and tolerances to report on deviations indicative of performance problems.

The Customer only needs to identify their critical hosts, interfaces and/or applications, and Cascade will automatically baseline their behavior and report on deviations indicative of performance problems.

The Performance Analytics use knowledge of hosts, interfaces, and/or applications are able to detect security threats such as host scans and worms.

After baselining is completed, Cascade can re-route congested traffic to avoid congested application delivery paths.

Accessing the Cascade Profiler's MIB by third-party applications for monitoring.

Obtaining interface information from routers.

Obtaining host MAC address information from switches.

Obtaining network device status through the Cascade Profiler receiving SNMP traps.

A, B, and D.

You can connect directly to the Cascade Shark with Cascade Pilot to begin analysis.

You can connect directly to the Cascade Shark with Cascade Gateway to begin analysis.

You can start analysis on the Cascade Profiler based upon flow data that has been sent from Cascade Shark to Cascade Profiler.

You can export data from a capture job directly to a packet capture (pcap) file and open in any tool that accepts pcap format.

You can start by loading views of the data from the Cascade Shark Appliance Web GUI before export to Wireshark.

Under the traffic reports Advanced Tab, place "192.168.1.100" in the Host field – select "Acting as Server" in the drop down, enter "tcp/25" in the Protocol field and select "Hosts" in the "report-by" pull down.

Under the traffic reports Advanced Tab, place "192.168.1.100" in the Host field – select "Acting as Server" in the drop down, enter "tcp/25" in the Protocol field and select "Peers Hosts" in the "report-by" pull down.

Under the traffic reports Advanced Tab, place "192.168.1.100" in the Host field – select "Acting as Client and Server" in the drop down, enter "tcp-25" in the Protocol field and select "Hosts" in the "report-by" pull down.

Under the "Quick Reports" pull down from the dashboard page, select "Host" enter the IP Address and hit return.

Determines the lowest value that can be used to create a service mapping for one application segment.

Specifies the minimum real value (fixed threshold) that will trigger an alert.

Sets the highest value that can be used to create a service mapping for one application segment.

Specifies the minimum amount of change that the policy can treat as a deviation from normal behavior when creating an Analytic.

UDP flow

TCP flow

An RST after the fifth data packet

Retransmitted ACK's

Retransmitted FIN's

v5 & v9

v1

v7 & v8

All of the above

None of the above

Cascade, User Defined, Packeteer, NBAR

Cascade, User Defined, Packeteer, NBAR, Steelhead appliance

Cascade, Packeteer, NBAR, Steelhead Appliance

Cascade, User Defined, Cisco, Netscreen, Steelhead appliance

host/group A "Track in aggregate" host/group B "track per host".

host/group A "track per host" host/group B "track in aggregate".

host/group A "track in aggregate" host/group B "track in aggregate".

host/group A "track per user" host/group B "track per user".

a user defined policy cannot support this scenario because it involves tracking traffic to external hosts.

Send an email when the traffic reaches at least 1MB/sec.

Notify all Cascade Pilot users connected to a specific Cascade Shark appliance when a specified traffic event occurs.

Create a Web traffic report with a specific time window.

Start a Capture Job each time the VoIP traffic goes below 2MB/sec.

Network Round Trip measurement

Packet logging

Server Delay measurement

Connection Throughput measurement

Retransmission measurement

L7 application fingerprint checking

When the file is opened in Cascade Pilot for analysis.

When the file is imported into Cascade Pilot for analysis.

When the first view is applied to the file.

When "Add Trend Index" is selected from a right-click menu within Cascade Pilot.

When the file is copied onto a Cascade Shark appliance.

2000

4000

20000

40000

200000

400000

HTTP Object load times can be analyzed with full packet capture

SSL Decryption can be used without any special key imports provided the start of the TCP conversation is captured

Software Agents are required on Servers in order to measure the Network Round trip time of applications

ICMP (ping echo/response) must be used in order to measure Network Round Trip time

NetFlow records can be summarized to provide utilization on a router interface

Administrator

Operator

Monitor

Dashboard Viewer

dbadmin

Event Viewer

View Packets

Error Report

Restart Service

View Switch Port

External Link