299-01 Sample Questions Answers

Ask Riverbed Support to send you the proper View to use.

Open the View folders in Cascade Pilot to look for a View named "Round-trip time".

Use the View search box and enter "round".

Use the Help menu and search for round.

11 for the Cascade Profiler, 3 Cascade Gateways

10 for the Cascade Profiler, 3 Cascade Gateways

11 for the Cascade Profiler, 5 Cascade Gateways

10 for the Cascade Profiler, 5 Cascade Gateways

12 for the Cascade Profiler, 4 Cascade Gateways

SNMP to send traps to trap receivers.

SNMP to discover switch ports associated with IP addresses.

SNMP to discover router interface capacities.

SNMP to discover router CPU utilization.

You must have at least three days of history of 15 minute rollups before saving the analytic.

You must have at least three days of history of 15 minute rollups before the analytic initializes.

If you include all possible metrics, but there is no possibility of measuring response time due to lack of Sensor coverage, the analytic will fail to initialize.

The analytic will not alert for a minimum of 1 week during baseline collection.

Both B and C.

Cascade Shark

Router

Layer 3 switch

Steelhead appliance

Cascade Sensor

40

65

17

55

425

Applications, Ports/Protocols, QOS, Servers, Clients

Ports/Protocols, QOS, Servers, Clients

Applications, Ports/Protocols,

Applications, Ports/Protocols, QOS, Servers, Clients, Interfaces

No, because a link analytic can monitor only a single interface.

Yes, one can define separate link congestion analytic policies for each WAN interface.

No, because one can only define specific ports to include on a link congestion policy.

Yes, because one can define a port group that includes every UDP and TCP port except for those that include the expected traffic, and that port group can be used for the link congestion analytic policy.

No, and both A and C include valid reasons.

Send an email when the traffic reaches at least 1MB/sec.

Notify all Cascade Pilot users connected to a specific Cascade Shark appliance when a specified traffic event occurs.

Create a Web traffic report with a specific time window.

Start a Capture Job each time the VoIP traffic goes below 2MB/sec.

SNMPv1 Only

SNMPv2 Only

SNMPv1 and SNMPv2

SNMPv1 and SNMPv3

You can connect directly to the Cascade Shark with Cascade Pilot to begin analysis.

You can connect directly to the Cascade Shark with Cascade Gateway to begin analysis.

You can start analysis on the Cascade Profiler based upon flow data that has been sent from Cascade Shark to Cascade Profiler.

You can export data from a capture job directly to a packet capture (pcap) file and open in any tool that accepts pcap format.

You can start by loading views of the data from the Cascade Shark Appliance Web GUI before export to Wireshark.

Copy the file onto a Cascade Shark to ensure better performance.

Create an index so that processing of the View analytics will be faster.

Apply a View with a specific filter.

Use Wireshark tools to split the trace file in multiple and smaller trace files.

They all point to the same NTP server.

The Profiler, ideally, points to an NTP server (although it can use local time as well), the Gateway and Sensor get their time information from the Profiler which acts as their NTP Server.

For security reasons, all components use local time. The same time should be set on each component.

They all synchronize their time via timestamps in Netflow sources.

1

2

3

4

5

Nessus

Rapid7

Qualys

Retina

nCircle

MBSA

http://10.1.1.1

https://10.1.1.1

https://10.1.1.1:443

https://10.1.1.1:8080

http://10.1.1.1:8080

Unconditionally overwrite any existing layer 7 application mapping.

Apply to flows that are either Unclassified, or did not match any known layer 7 signatures

Apply only to flows that are not seen by a Cascade Sensor or other layer 7 signature-based device.

None of the above.

HTTP Object load times can be analyzed with full packet capture

SSL Decryption can be used without any special key imports provided the start of the TCP conversation is captured

Software Agents are required on Servers in order to measure the Network Round trip time of applications

ICMP (ping echo/response) must be used in order to measure Network Round Trip time

NetFlow records can be summarized to provide utilization on a router interface

The trace clip is likely smaller in size, so views load faster.

The trace clip is moved to the local system, so views load faster.

The trace clip has a base set of views pre-applied, so analysis is faster.

The trace clip is guaranteed to have trend/index data, so views load faster.

The flow includes the UDP protocol.

The traffic was not reported by a Cascade Sensor or Cascade Shark appliance.

The traffic was not reported by a Steelhead appliance's CascadeFlow

The start time for the connection was prior to the timeframe selected for the traffic query.

The packets involved in the initial setup of the TCP connection were not seen by a Cascade Sensor or Cascade Shark appliance.

Three weeks of historical traffic between the clients and servers defined on the policy.

Three days of historical traffic between the clients and servers defined on the policy.

Three weeks of historical traffic between the clients and servers defined on the policy, where retransmissions were reported in more than 50% of the 15 min windows over the three week period.

Three days of historical traffic between the clients and servers defined on the policy, where retransmissions were reported in more than 50% of the 15 min windows over the three day period.

The timeframe required to collect the baseline is not fixed, and is based on the variance of the traffic being monitored.

To de-duplicate duplicate flows sent to the Cascade Profiler appliance caused by the way different Cascade Shark ports may see the same UDP/TCP sessions.

To de-duplicate duplicate flows sent to the Cascade Profiler appliance caused by use of the Aggregating Port seeing the same UDP/TCP sessions.

To de-duplicate duplicate packets that may be collected by the Cascade Shark caused by the way Port Mirroring is configured on a switch.

To de-duplicate duplicate packets that may be collected by the Cascade Shark caused by the way filtering is used on a capture job.

All of the above

An ACL might exist on the flow source (router) and the Cascade Standard Profiler IP address is not in it.

SNMP is not enabled.

The correct IP address of the flow source was not entered into the GUI.

The SNMP read string provided and entered might not be correct.

The flow source is not using the same NTP source as the Cascade Gateway.

Number of connections per second

Average response time

TCP resets

TCP retransmission

Number of jumbo frames

CPU and memory utilization of server

In-chart tool controls

Data Retention Time

Chart Color scheme

Application of a Filter

Sampling Time

The default hostgroup type used can be changed from Configuration > General Settings.

Different hostgroup types can be used for monitoring End User segments for each Service.

While editing the Service one has the capability to select all sites or a subset of sites to include for monitoring.

When adding a Service Health by Location widget to a dashboard, one has the capability to include all locations or a subset (maximum of 10).

The default hostgroup type used for monitoring End User segments is ByLocation.

SNMP based technology can query a network device for statistics such as number of packets and bytes sent out an interface but typically doesn't have conversation-level details (such as which IP Addresses where talking at a given time)

NetFlow based technology can query a network device for statistics such as number of packets and bytes sent out an interface but typically doesn't have conversation-level details (such as which IP Addresses where talking at a given time)

NetFlow based technology does NOT typically include response time information, packet inspection is necessary to measure response times

It is NOT possible to understand which conversations traversed a link without full packet capture

SNMP based technology querying routers in the network can be used to view end to end conversations across a network to determine top talkers

Guarantees that the ifIndex values for various interfaces remain stable across Steelhead appliance reboots and reconfiguration.

Guarantees that the ifIndex values for various interfaces remain stable across network disruptions preventing re-polling

Guarantees that the ifdescription values for various interfaces remain correctly mapped across Steelhead appliance reboots and reconfiguration.

Guarantees that the ifdescription values for various interfaces are remapped across Steelhead appliance service shutdowns.

Identify connection duration.

Look for high server side packet counts.

Look for high number of reset.

Run a report with a Connection Graph.

Run a report on the WAN Interface of the Steelhead.

Run a report with Flow List and look at the topology columns.

Allows Cascade Pilot to load views that take advantage of the Index more quickly.

Includes the number of bytes and packets for each conversation seen by the Cascade Shark appliance.

It is configured on a per-port basis.

It is configured using the sa-wizard as part of the initial configuration.

It is enabled by default per capture job.

Enable SPAN or mirror port on a switch in their datacenter, which has visibility of the SQL traffic in question.

Enable a SPAN or mirror port all remote sites where users of the SQL application sit.

Enable NetFlow on at least all WAN routers that carry the SQL traffic.

Configure the SQL servers to send their SNMP traps to the Cascade Profiler.

Configure the SQL servers to send their SNMP traps to the Cascade Gateway.

SNMP polling from the Gateway

SNMP polling from the Profiler

SYSLOG

All of the above

None of the above

Netflow V5 or V9 with TTL export configured.

NetflowV9 with TTL export configured.

Any version of Netflow since they all export in/out interface information.

UDP port.

"192.168.1.0/24 Tokyo"

"Tokyo = 192.168.1.0/24"

"192.168.1.0-192.168.1.255 Tokyo"

"192.168.1.0;255.255.255.0 Tokyo"

A service segment is the update time period when devices send Netflow to Cascade Gateways.

A service segment is defined by its components and the applications and/or ports in use between them.

A service segment is defined as the front-end tier that directly services end users with an application.

A service segment is the update time period when Cascade Sensors send MNMP Flow to Cascade Profilers.

Zero Window Size, Retransmits, or FIN Flags observed

Increasing Window Size, Resets, Retransmits

Zero Window Size, Retransmits, Lost Packets

SYN, FIN, or RST flags observed

RST or FIN flag observed or Retransmits observed

By URL

By Regular Expression

By Packet Start offset

By ASCII String

By Hex String

By Error Code Type

On demand queries to the AD server(s)

A10 networks ID Series appliance

Active Directory audit logs

RADIUS

From views in the main workspace in PDF, Word, HTML and other formats.

From events that have occurred, also referred to as watches.

With customized information such as company logo and client name.

Including notes that are entered in Chart notes.

Including status of all remote devices (Cascade Shark appliances).

P2P application Activity

SpamBot Activity

Email traffic surge

Port Scan

P2P Port Activity

Traffic is being sent across the router's interfaces configured for flow export.

There are no firewalls blocking communication between router and Cascade Gateway.

There are no firewalls blocking communication between Cascade Gateway and Cascade Profiler.

The port being used for export on the router matches that which has been configured on the Cascade Gateway.

All of the above.

The license key is entered during installation. The license is activated either through an Internet connection or by phone.

The license key is entered during installation. The license must be activated through an Internet connection.

The license key is entered during installation. There is no activation but Cascade Pilot will detect if the license is already in use on the network.

There is no license key activation. The software image is shipped with the license key installed.

A single capture port can be specified.

Any combination of capture ports can be specified.

All capture ports on the Cascade Shark can be specified.

Trend/Index data has a default retention of seven days.

There is no Trend/Index data by default, it is recommended to set this as appropriate.

Each URL that is seen by the Sensor is shown on the dashboard or searchable via reporting.

Customer defined URL's are mapped to an application name which can then be shown on the dashboard, searched via reporting, or used in Analytic definitions.

URL's are tracked by either a Cascade Sensor or via NetFlow version 5 (or higher) export.

Cascade does not track URL's.

obtain MAC addresses.

improve accuracy of the security baseline.

force lease extensions longer to make tracking unique PCs easier.

obtain an IP for itself.

Performance and Availability

TCP Health

VoIP

Security

Health

User-defined Policy

1

2

5

8

10

A BPF packet filter

A disk space allocation

Time-based display resolution

Trend/Indexing parameters

Access credential information

View Packets

Error Report

Restart Service

View Switch Port

External Link

Interface centric

Application centric

Host centric

Port centric

The Cascade Profiler does not have two approaches

Applying a very complex filter statement.

Creating a non-sequential time index.

Creating a trace clip file with trend index data.

Interactively connecting charts from 2 or more views.

Creating a PDF report of a view that can be interactively updated.

Can be created from a single applied View.

Can work on local trace files only.

Can include more than two charts.

Is not available in the regular Cascade Pilot installation.

Select two views from the views panel using control-click then right click on one and select "Create Interactive View" from the drop-down menu.

After a Drill-Down from one view to another, right click on the Drill-Down view in the sources panel and select "Create Interactive View" from the drop-down menu.

Select any item (such as a host IP Address, Port or Protocol name) in the main workspace and right click on the item, then select "Create Interactive View" from the drop-down menu.

Select any view in the views panel, right-click it and select "Create Interactive View" from the drop-down menu.

Open the filters panel, apply an existing or new filter to the view then select "save as interactive view" from the home menu.

Internal hosts only

External hosts only

All hosts

Internal and External hosts only

Specified internal hosts plus the non-routable subnets

Allows enabling/disabling the detection of dips in the metric.

Allows tuning of the tolerance range of the metric.

Allows setting of a noise floor for the metric.

Allows adjusting the notifications for the metric.

Allows enabling/disabling the detection of spikes in the metric.

Symmetric

Radial tree

Vertical client/server dependency

Starburst

Horizontal tree

User name

Host IP address

Host MAC address

The physical switch port a specific host is connected to

Switch port traffic levels

Switch port status

SNMP traps from the switch

Watched items (where items are hosts, interface, etc.)

Top items (where items are hosts, interface, etc.)

Top usernames

Unacknowledged Events

Current Events

Last Day Events

Client Ports

Applications

Ports

Server

Unlimited

Ten

Four

Twenty

Three weeks

Three days

One day

Configurable from one minute to three weeks

Apply a View on the live interface and then start a Capture Job on the capture port to analyze traffic later.

Start a Capture Job on the capture port with a BPF filter and apply a View on the live interface for the same capture job.

Start a Capture Job on the capture port, apply a View on the live interface and create a trace clip for the time window of interest.

Never create a Capture Job to prevent packet drops.

Ensures Cascade is able to recreate the packets.

Essential for the flow de-duplication process.

Ensures the flow is delivered to the correct Gateway.

All of the above.

None of the above.

host_name, device_type, read_only_community_string, write_community_string

host_name, IP_address, read_only_community_string, write_community_string

host_name, IP_address, device_type, read_only_community_string, write_community_string

host_name, IP_address, device_type, read_only_community_string, write_community_string, pass phrase

Unlimited

Ten

Four

Twenty

Top Hosts

Top Applications

Public

Private

Devices and Interfaces Utilization

IP Addresses, Port Numbers, Protocol, TCP Flags, DSCP Marking, number of bits, number of packets, retransmitted bits

IP Addresses, Port Numbers, Protocol, TCP Flags, DSCP Marking, number of bits, number of packets, inbound/outbound interface ID

IP Addresses, MAC Addresses, Port Numbers, Protocol, DSCP Marking, number of bits, number of packets

IP Addresses, Port Numbers, Protocol, Round Trip Time, DSCP Marking, number of bits, number of packets

IP Addresses, Port Numbers, Protocol, Packet Latency, DSCP Marking, number of bits, number of packets

Cascade Gateway's poll via SNMP sources of Netflow, while Cascade Profiler, Cascade Gateway and Cascade Sensor sync NTP from a common source.

Cascade Profiler's poll via SNMP sources of Netflow, while Cascade Profiler, Cascade Gateway and Cascade Sensor sync NTP from a common source.

Cascade Profiler, Cascade Gateway and Cascade Sensor sync NTP from different sources, while Cascade Profiler's poll via SNMP sources of Netflow.

Cascade Profiler, Cascade Gateway and Cascade Sensor sync NTP from different sources, while Cascade Gateway's poll via SNMP sources of Netflow.

Cascade Profiler does all SNMP polling and is also the source of all NTP.

200,000 flows per minute per port

300,000 flows per minute per port

500,000 flows per minute per port

500,000 flows per minute total

600,000 flows per minute total

Run Automatic grouping for all group types.

Configure an Undefined group type with definition 0.0.0.0/0; confirm there are no entries when you 'view members' of this 'Undefined' group'.

There is no way to do this and successfully capture all the IP addresses.

Configure an Undefined group type with definition 0.0.0.0/32.

Run a report by hosts and look for undefined groups.