Monitoring and operations
Topic 21 of 26. 45 questions: 21 pick one, 5 pick all, 6 type it, 4 put in order, 9 interview
What this topic covers
- SNMP v1 v2c v3 and security
- MIB and OID
- traps vs informs vs polling
- syslog and severity levels 0 to 7
- NetFlow IPFIX sFlow and what they tell you
- streaming telemetry vs SNMP polling
- NTP for logs
- IP SLA
- baselines and thresholds
- monitoring tools and dashboards
- change management and maintenance windows
- backups of configs
- MTTR and MTBF
- incident response and postmortems
- documentation and diagrams
Study it in depth on Octet.
- 1The security team wants SNMP traffic between the monitoring server and the routers to be both authenticated and encrypted. Which setup meets that?
- 2On which UDP port does an SNMP manager listen for traps and informs sent by its agents?
- 3A new firewall sits between the NMS and a branch router. Its only SNMP rule permits UDP 162 from the router to the NMS. What does the NMS see?
- 4Put the SNMPv3 security levels in order, from least secure to most secure.
- 5An auditor asks whether SNMP traffic between this router and the NMS is encrypted. Based on the configuration, which statement is true?
- 6Which of these did SNMPv2c add over SNMPv1? Choose all that apply.
- 7The sysName object is 1.3.6.1.2.1.1.5, but you poll 1.3.6.1.2.1.1.5.0. What does the trailing .0 mean?
- 8You walk three IF-MIB columns on R1. Which interface has failed, meaning it is administratively up but operationally down? Give its name.
- 9An NMS polls ifInOctets every 5 minutes on a busy 10 Gbps uplink, and the traffic graph shows values that are far too low and jump around. What is the fix?
- 10What are a MIB and an OID, and how does a monitoring system read an interface's traffic counter?
- 11What does an SNMP inform give you that a trap does not?
- 12Do you rely on SNMP polling or on traps to know that a device is in trouble? Explain the trade-off.
- 13Put the syslog severity levels in order, from most severe (level 0) to least severe (level 7).
- 14A switch is configured with logging trap warnings. Which of these messages reach the syslog server? Choose all that apply.
- 15Which UDP port does a syslog server listen on by default?
- 16A Cisco router logs with its default facility, local7, which is facility code 23. What PRI value appears at the start of a severity 5 message, written as <PRI>?
- 17You are connected to a Cisco IOS router over SSH and have turned on a debug, but no debug or log output appears in your session. What is the most likely reason?
- 18Both routers use the same logging template, and you are building an incident timeline from their messages. What does R2's line tell you?
- 19Which of these help you line up log messages from many devices during an incident? Choose all that apply.
- 20SNMP shows the WAN link at 95 percent and users say the network is slow. Which data tells you which hosts and applications are using the link?
- 21What is the main difference between sFlow and NetFlow?
- 22A nightly backup runs for two hours at a steady 400 Mbps through R1. On the flow collector it shows up as a few huge spikes about 30 minutes apart instead of a flat line. Why?
- 23Which questions can NetFlow answer that SNMP interface counters cannot? Choose all that apply.
- 24What is streaming telemetry, and why do teams move to it from SNMP polling?
- 25A 10 Gbps uplink averages 35 percent on 5-minute SNMP graphs, yet its output drops counter keeps rising and users report brief stalls. What is the most likely explanation?
- 26What does Cisco IP SLA do?
- 27A capture on GigabitEthernet0/0/0 shows no ICMP packets to 198.51.100.200 at all. What is missing from this configuration?
- 28What is a baseline, and how do you use it to set alert thresholds?
- 29Your ISP bills on the 95th percentile of 5-minute samples over a 30-day month. How many of the highest samples are discarded before the billing rate is read?
- 30The NOC receives about 4,000 alerts a day and missed a real core outage that was buried among them. What is the best first fix?
- 31Design the monitoring for a network of 200 sites. What tools and data would you put in place, and what would the dashboards show?
- 32Put the steps of a planned network change in order, first to last.
- 33In ITIL terms, what type of change is adding an access port to an existing VLAN by following a documented, pre-approved procedure?
- 34Which of these belong in the rollback plan of a network change? Choose all that apply.
- 35Walk me through how you plan and run a risky change in a maintenance window.
- 36Nightly config backups already exist. During an incident you want to see exactly what changed on a switch since yesterday. Which setup makes that quick?
- 37After last night's change, users in VLANs 10, 20 and 30 behind Port-channel10 lost access. The backup repository shows this diff for DSW1. What happened?
- 38Which of these improves MTTR rather than MTBF?
- 39A device has an MTBF of 9,996 hours and an MTTR of 4 hours. What is its availability, as a percentage?
- 40A network outage is in progress. Put the incident steps in order, first to last.
- 41During a major outage with several engineers working on it, what should the incident lead (incident commander) mainly do?
- 42You are on call and get paged because a branch office is completely down. Walk me through what you do.
- 43This is the timeline of last night's outage. Where did the time go, and what actions should come out of the postmortem?
- 44Which of these belongs on a layer 3 (logical) network diagram rather than a layer 1 (physical) one?
- 45What documentation should a network team keep, and how do you keep it up to date?