201-01 Sample Questions Answers

A logical collection of IP Addresses that can be grouped by region, application, and function.

A set of netflow collectors.

NetFlow senders.

A group of Ports.

A collection of MAC Addresses.

Sufficient capacity within a virtualization infrastructure to support the minimum or recommended requirements for the software being deployed.

It is important to consider future growth within the organization and whether that growth will impact NetProfiler needs in the short and medium term future in terms of capacity, visibility, or other aspect.

Whether there is an existing virtualization deployment.

There are no important issues to consider when choosing whether to deploy a physical or virtual NetProfiler solution.

Items such Mean Opinion Score (MOS) scores, jitter, and packet loss – important indicators of potential voice quality issues.

PBX Health statistics.

Ability to break into a conversation for emergency interruption services.

Ability to assure 911 Emergency dialing is available.

All of the above.

Express

Standard Profiler

Enterprise Profiler

B and C

A, B, and C

A downloadable customized view from the online Cascade community.

Any view that is applied to live devices and dynamically updated.

A view that can be created after drill-down from one view to another.

Any view that was created by applying a traffic filter.

All views within Cascade Pilot are considered interactive views.

Response Time

Layer 4 Application Classification Mapping

Layer 7 Application Classification Mapping

Network Throughput

Network Round Trip Time

Tooltips is made visible by hovering over the icon for a view of folder.

Download Tooltip manual from Riverbed support.

Tooltip is disabled by default.

Tooltips are included in the Packet Analyzer manual.

NetFlow v5

CascadeFlow

IPFix

cflowd

NetFlow v9

All of the above

http://10.1.1.1

https://10.1.1.1

https://10.1.1.1:443

https://10.1.1.1:8080

http://10.1.1.1:8080

An Application is a collection of Host IP Addresses.

An Application is a Layer-7 protocol or combination of IP Address and Port.

An Application is a list of TCP Port Numbers.

An Application is a combination of several Host Group Types.

System->Devices & Interfaces

Configuration->Accounts

Definitions->Host Groups

Configuration->General Settings

Dashboard

They are based upon the 6-bit Differentiated Services Code Point (DSCP).

They are based upon Host Group definitions, defined within the Cascade GUI.

They are based upon Application definitions, defined within the Cascade GUI.

They are based upon Port definitions, defined within the Cascade GUI.

NetExpress is only good for extremely tiny enterprises with a few hundred hosts that want a single, company-wide visibility monitoring solution.

Small enterprises with a few thousand hosts that want a single, company-wide visibility monitoring solution.

Large enterprises with hundreds of thousands of hosts that want a single, company-wide visibility monitoring solution.

NetExpress is a good solution for any sized organization that want a single, company-wide visibility monitoring solution.

Medium-size enterprises with tens of thousands of hosts that want a single, company-wide visibility monitoring solution.

In UI preferences

In behavior analysis - policies

In behavior analysis - notifications

In behaviors analysis - events

In configuration - general settings

Write-to-disk speed

NetFlow consumption rate required

Protocol support required

Capture port types required

Packet storage required

Adding an alerting threshold for the policy in question

Adding the host or subnet to the special pre-defined custom hostgroup called “trusted-hosts” that suppresses alerting from all security policies.

Changing the Advanced Setting for the policy

Changing the Global Policy Settings

Suppressing events against a specific host or subnet is not possible

Roll remote devices via SNMP at the request of NetProfiler.

Process up to tens of millions of raw flows per minute.

Provide analysis of incoming flows and identify anomalies in traffic patterns.

Selectively forward flows from original sources to third party colectors.

Selectively forward flows from original sources to NetProfiler(s).

Security Events

Performance and Availability Events

Current Events

Unacknowledged Events

Public Events

Private Events

Per User Events

Through the Reporting ribbon

Through the search bar in the Views pane

By hovering the cursor over the icon that precedes each View listed in the Views pane

Through the Web Interface

Using a Layer4 Mapping (combination of IP Address and TCP/UDP Port)

Using a Layer7 Deep Packet Inspection

Using a Host Group

Using Switch Port Discovery

Using Firewall Policy Import

250GB

500GB

750GB

1TB

SNMPv1 Only

SNMPv2 Only

SNMPv1 and SNMPv2

SNMPv1 and SNMPv3

User Defined Policies

SNMP Polling

Dashboards

Services

Navigate Network

Source and Destination IP Address of endstations

Source and Destination MAC Address of endstations

Source and Destination Hardware Port Numbers of endstations

Source and Destination UDP or TCP Port Numbers

TCP Flags used

Install more hard drives.

Change the RAID configuration.

Decrease the snapshot storage in the web user interface.

Install an Expression Chassis.

NetExpress

Any Windows server platform

NetProfiler

Riverbed License Portal

NetShark

Applications

TCP Ports

Port Groups

QoS Name

Host Group Name

All the above

When one host on the network attaches to a network printer-scanner device and is able to exploit the printer-scanner to download all material scanned on the device.

When one host on the network is infected with malware and the malware scans all of the files resident on the infected system looking for exploits.

When several hosts on the network send a high volume of traffic to a single host to try to exhaust the resources of the host.

When one host on the network send ping packets or other packet types to multiple other devices on the network to determine which hosts are available for further exploit.

Ensuring the interface of the Cascade Profiler is on the same subnet as the router, as NetFlow is not routable.

Using the “tcp/(n) + 1” port numbering scheme to ensure this router’s NetFlow is unique from all other routers.

Ensuring the router has IP connectivity to the Cascade Gateway.

Ensuring the interface of the Cascade Gateway is on the same subnet as the router, as NetFlow is not routable.

Using the “udp/(n) + 1” port numbering scheme to ensure this router’s NetFlow is unique from all other routers.

SMTP or SNMP must be configured.

I have to have an account on Cascade.

Lotus Notes has to be installed.

I need a Riverbed e-mail account.

Host Baseline Profiles

Custom Port Definitions

Host Groupings

Mitigation Configuration

Default Host Group Type to use on the User Interface and Reports

Whether hosts will be displayed by IP address or DNS/DHCP hostname

User’s Timezone to use for the User Interface and Reports

Option to control whether bandwidth is reported in Bits or Bytes

Host group definitions for mapping IP subnets into Custom host groups