CompTIA Network+ N10-009 SNMP Flow Logs Packet Capture And Monitoring Practice Test

 

Objective 3.2 • 20 original questions

This CompTIA Network+ N10-009 practice test focuses on network monitoring technologies. All questions are original ExamSnap scenarios aligned to the current N10-009 blueprint; they are not copied from CompTIA exam content. Use the complete N10-009 collection for broader practice across all five domains. For broader exam preparation, review the CompTIA Network+ N10-009 Exam Dumps page.

Instructions: Select the best answer for each question. Review the explanation after answering; each distractor includes a reason it is not the best choice for that scenario.

Question 1

At Litware Manufacturing, a systems administrator is reviewing a network change. The requirement is to collect interface counters and device statistics on a schedule. Which option is the best fit? The decision applies to a branch-office rollout.

1. Log aggregation
2. API integration
3. Configuration monitoring
4. Flow data
5. SNMP polling

Correct answer: E

Why: A manager queries device MIB objects to collect status and performance information. This directly satisfies the requirement: collect interface counters and device statistics on a schedule.

Option review:

A: Centralizes logs from many devices for search, retention, and correlation. However, it does not most directly satisfy the requirement in this scenario: collect interface counters and device statistics on a schedule.

B: Allows monitoring or automation systems to exchange data programmatically. However, it does not most directly satisfy the requirement in this scenario: collect interface counters and device statistics on a schedule.

C: Tracks configuration state and changes to identify unauthorized drift. However, it does not most directly satisfy the requirement in this scenario: collect interface counters and device statistics on a schedule.

D: Summarizes conversations/traffic metadata such as sources, destinations, ports, and byte counts. However, it does not most directly satisfy the requirement in this scenario: collect interface counters and device statistics on a schedule.

E: A manager queries device MIB objects to collect status and performance information. This directly satisfies the requirement: collect interface counters and device statistics on a schedule.

Learning point: Use SNMP polling when the key requirement is to collect interface counters and device statistics on a schedule.

Question 2

A ticket at Woodgrove Bank says the team must receive immediate device-generated alerts without waiting for the next poll. Which technology or concept most directly addresses this requirement? The decision applies to a campus refresh.

1. SNMPv3
2. Availability monitoring
3. SNMP trap
4. SIEM
5. API integration

Correct answer: C

Why: A device proactively sends an asynchronous event notification to a manager. This directly satisfies the requirement: receive immediate device-generated alerts without waiting for the next poll.

Option review:

A: Adds authentication and encryption capabilities absent from community-string-only deployments. However, it does not most directly satisfy the requirement in this scenario: receive immediate device-generated alerts without waiting for the next poll.

B: Checks whether services/devices remain reachable and responsive. However, it does not most directly satisfy the requirement in this scenario: receive immediate device-generated alerts without waiting for the next poll.

C: A device proactively sends an asynchronous event notification to a manager. This directly satisfies the requirement: receive immediate device-generated alerts without waiting for the next poll.

D: Correlates security/event data and applies detection/analytics across collected logs. However, it does not most directly satisfy the requirement in this scenario: receive immediate device-generated alerts without waiting for the next poll.

E: Allows monitoring or automation systems to exchange data programmatically. However, it does not most directly satisfy the requirement in this scenario: receive immediate device-generated alerts without waiting for the next poll.

Learning point: Use SNMP trap when the key requirement is to receive immediate device-generated alerts without waiting for the next poll.

Question 3

During a design meeting at Blue Yonder Airlines, the junior network administrator needs to monitor devices using the most secure SNMP version listed. What should be selected? The decision applies to a data-center segment.

1. API integration
2. Network discovery
3. SNMP polling
4. MIB
5. SNMPv3

Correct answer: E

Why: Adds authentication and encryption capabilities absent from community-string-only deployments. This directly satisfies the requirement: monitor devices using the most secure SNMP version listed.

Option review:

A: Allows monitoring or automation systems to exchange data programmatically. However, it does not most directly satisfy the requirement in this scenario: monitor devices using the most secure SNMP version listed.

B: Finds devices and services on the network through scans or scheduled discovery. However, it does not most directly satisfy the requirement in this scenario: monitor devices using the most secure SNMP version listed.

C: A manager queries device MIB objects to collect status and performance information. However, it does not most directly satisfy the requirement in this scenario: monitor devices using the most secure SNMP version listed.

D: Defines managed objects and identifiers that SNMP managers can query. However, it does not most directly satisfy the requirement in this scenario: monitor devices using the most secure SNMP version listed.

E: Adds authentication and encryption capabilities absent from community-string-only deployments. This directly satisfies the requirement: monitor devices using the most secure SNMP version listed.

Learning point: Use SNMPv3 when the key requirement is to monitor devices using the most secure SNMP version listed.

Question 4

Contoso Health is updating its network standard. Which option best meets the need to identify which device variables and OIDs are available for SNMP monitoring? The decision applies to a remote-site migration.

1. Flow data
2. Configuration monitoring
3. API integration
4. SNMP polling
5. MIB

Correct answer: E

Why: Defines managed objects and identifiers that SNMP managers can query. This directly satisfies the requirement: identify which device variables and OIDs are available for SNMP monitoring.

Option review:

A: Summarizes conversations/traffic metadata such as sources, destinations, ports, and byte counts. However, it does not most directly satisfy the requirement in this scenario: identify which device variables and OIDs are available for SNMP monitoring.

B: Tracks configuration state and changes to identify unauthorized drift. However, it does not most directly satisfy the requirement in this scenario: identify which device variables and OIDs are available for SNMP monitoring.

C: Allows monitoring or automation systems to exchange data programmatically. However, it does not most directly satisfy the requirement in this scenario: identify which device variables and OIDs are available for SNMP monitoring.

D: A manager queries device MIB objects to collect status and performance information. However, it does not most directly satisfy the requirement in this scenario: identify which device variables and OIDs are available for SNMP monitoring.

E: Defines managed objects and identifiers that SNMP managers can query. This directly satisfies the requirement: identify which device variables and OIDs are available for SNMP monitoring.

Learning point: Use MIB when the key requirement is to identify which device variables and OIDs are available for SNMP monitoring.

Question 5

A field technician at Litware Manufacturing is validating a proposed solution. The design must analyze who is talking to whom without storing full packet payloads. Which answer is most appropriate? The decision applies to a operations lab.

1. Anomaly alerting
2. Configuration monitoring
3. Flow data
4. SNMPv3
5. Port mirroring

Correct answer: C

Why: Summarizes conversations/traffic metadata such as sources, destinations, ports, and byte counts. This directly satisfies the requirement: analyze who is talking to whom without storing full packet payloads.

Option review:

A: Notifies operators when observed behavior deviates from defined thresholds or learned baselines. However, it does not most directly satisfy the requirement in this scenario: analyze who is talking to whom without storing full packet payloads.

B: Tracks configuration state and changes to identify unauthorized drift. However, it does not most directly satisfy the requirement in this scenario: analyze who is talking to whom without storing full packet payloads.

C: Summarizes conversations/traffic metadata such as sources, destinations, ports, and byte counts. This directly satisfies the requirement: analyze who is talking to whom without storing full packet payloads.

D: Adds authentication and encryption capabilities absent from community-string-only deployments. However, it does not most directly satisfy the requirement in this scenario: analyze who is talking to whom without storing full packet payloads.

E: Copies switch traffic from selected ports/VLANs to an analysis port. However, it does not most directly satisfy the requirement in this scenario: analyze who is talking to whom without storing full packet payloads.

Learning point: Use Flow data when the key requirement is to analyze who is talking to whom without storing full packet payloads.

Question 6

For a new deployment at Woodgrove Bank, the networking team wants to inspect headers and payload details for a specific network conversation. Which choice most directly satisfies the goal? The decision applies to a production maintenance window.

1. Packet capture
2. Anomaly alerting
3. Baseline metrics
4. SIEM
5. Flow data

Correct answer: A

Why: Records full packets for protocol-level inspection and troubleshooting. This directly satisfies the requirement: inspect headers and payload details for a specific network conversation.

Option review:

A: Records full packets for protocol-level inspection and troubleshooting. This directly satisfies the requirement: inspect headers and payload details for a specific network conversation.

B: Notifies operators when observed behavior deviates from defined thresholds or learned baselines. However, it does not most directly satisfy the requirement in this scenario: inspect headers and payload details for a specific network conversation.

C: Establish normal performance levels so deviations can be recognized. However, it does not most directly satisfy the requirement in this scenario: inspect headers and payload details for a specific network conversation.

D: Correlates security/event data and applies detection/analytics across collected logs. However, it does not most directly satisfy the requirement in this scenario: inspect headers and payload details for a specific network conversation.

E: Summarizes conversations/traffic metadata such as sources, destinations, ports, and byte counts. However, it does not most directly satisfy the requirement in this scenario: inspect headers and payload details for a specific network conversation.

Learning point: Use Packet capture when the key requirement is to inspect headers and payload details for a specific network conversation.

Question 7

At Blue Yonder Airlines, a systems administrator is reviewing a network change. The requirement is to determine whether current utilization is abnormal compared with normal behavior. Which option is the best fit? The decision applies to a new floor deployment.

1. Availability monitoring
2. Baseline metrics
3. Flow data
4. API integration
5. SNMPv3

Correct answer: B

Why: Establish normal performance levels so deviations can be recognized. This directly satisfies the requirement: determine whether current utilization is abnormal compared with normal behavior.

Option review:

A: Checks whether services/devices remain reachable and responsive. However, it does not most directly satisfy the requirement in this scenario: determine whether current utilization is abnormal compared with normal behavior.

B: Establish normal performance levels so deviations can be recognized. This directly satisfies the requirement: determine whether current utilization is abnormal compared with normal behavior.

C: Summarizes conversations/traffic metadata such as sources, destinations, ports, and byte counts. However, it does not most directly satisfy the requirement in this scenario: determine whether current utilization is abnormal compared with normal behavior.

D: Allows monitoring or automation systems to exchange data programmatically. However, it does not most directly satisfy the requirement in this scenario: determine whether current utilization is abnormal compared with normal behavior.

E: Adds authentication and encryption capabilities absent from community-string-only deployments. However, it does not most directly satisfy the requirement in this scenario: determine whether current utilization is abnormal compared with normal behavior.

Learning point: Use Baseline metrics when the key requirement is to determine whether current utilization is abnormal compared with normal behavior.

Question 8

A ticket at Contoso Health says the team must search events from many network devices in one place. Which technology or concept most directly addresses this requirement? The decision applies to a service-recovery review.

1. SIEM
2. Log aggregation
3. Flow data
4. Baseline metrics
5. Packet capture

Correct answer: B

Why: Centralizes logs from many devices for search, retention, and correlation. This directly satisfies the requirement: search events from many network devices in one place.

Option review:

A: Correlates security/event data and applies detection/analytics across collected logs. However, it does not most directly satisfy the requirement in this scenario: search events from many network devices in one place.

B: Centralizes logs from many devices for search, retention, and correlation. This directly satisfies the requirement: search events from many network devices in one place.

C: Summarizes conversations/traffic metadata such as sources, destinations, ports, and byte counts. However, it does not most directly satisfy the requirement in this scenario: search events from many network devices in one place.

D: Establish normal performance levels so deviations can be recognized. However, it does not most directly satisfy the requirement in this scenario: search events from many network devices in one place.

E: Records full packets for protocol-level inspection and troubleshooting. However, it does not most directly satisfy the requirement in this scenario: search events from many network devices in one place.

Learning point: Use Log aggregation when the key requirement is to search events from many network devices in one place.

Question 9

During a design meeting at Litware Manufacturing, the junior network administrator needs to correlate events from many systems to identify suspicious patterns. What should be selected? The decision applies to a branch-office rollout.

1. Log aggregation
2. SIEM
3. MIB
4. Flow data
5. Port mirroring

Correct answer: B

Why: Correlates security/event data and applies detection/analytics across collected logs. This directly satisfies the requirement: correlate events from many systems to identify suspicious patterns.

Option review:

A: Centralizes logs from many devices for search, retention, and correlation. However, it does not most directly satisfy the requirement in this scenario: correlate events from many systems to identify suspicious patterns.

B: Correlates security/event data and applies detection/analytics across collected logs. This directly satisfies the requirement: correlate events from many systems to identify suspicious patterns.

C: Defines managed objects and identifiers that SNMP managers can query. However, it does not most directly satisfy the requirement in this scenario: correlate events from many systems to identify suspicious patterns.

D: Summarizes conversations/traffic metadata such as sources, destinations, ports, and byte counts. However, it does not most directly satisfy the requirement in this scenario: correlate events from many systems to identify suspicious patterns.

E: Copies switch traffic from selected ports/VLANs to an analysis port. However, it does not most directly satisfy the requirement in this scenario: correlate events from many systems to identify suspicious patterns.

Learning point: Use SIEM when the key requirement is to correlate events from many systems to identify suspicious patterns.

Question 10

Woodgrove Bank is updating its network standard. Which option best meets the need to feed a protocol analyzer with a copy of production switch traffic? The decision applies to a campus refresh.

1. SNMP polling
2. Port mirroring
3. SNMP trap
4. Log aggregation
5. SNMPv3

Correct answer: B

Why: Copies switch traffic from selected ports/VLANs to an analysis port. This directly satisfies the requirement: feed a protocol analyzer with a copy of production switch traffic.

Option review:

A: A manager queries device MIB objects to collect status and performance information. However, it does not most directly satisfy the requirement in this scenario: feed a protocol analyzer with a copy of production switch traffic.

B: Copies switch traffic from selected ports/VLANs to an analysis port. This directly satisfies the requirement: feed a protocol analyzer with a copy of production switch traffic.

C: A device proactively sends an asynchronous event notification to a manager. However, it does not most directly satisfy the requirement in this scenario: feed a protocol analyzer with a copy of production switch traffic.

D: Centralizes logs from many devices for search, retention, and correlation. However, it does not most directly satisfy the requirement in this scenario: feed a protocol analyzer with a copy of production switch traffic.

E: Adds authentication and encryption capabilities absent from community-string-only deployments. However, it does not most directly satisfy the requirement in this scenario: feed a protocol analyzer with a copy of production switch traffic.

Learning point: Use Port mirroring when the key requirement is to feed a protocol analyzer with a copy of production switch traffic.

Question 11

A field technician at Blue Yonder Airlines is validating a proposed solution. The design must integrate a monitoring platform with another system without manual exports. Which answer is most appropriate? The decision applies to a data-center segment.

1. API integration
2. SNMP trap
3. SIEM
4. MIB
5. Port mirroring

Correct answer: A

Why: Allows monitoring or automation systems to exchange data programmatically. This directly satisfies the requirement: integrate a monitoring platform with another system without manual exports.

Option review:

A: Allows monitoring or automation systems to exchange data programmatically. This directly satisfies the requirement: integrate a monitoring platform with another system without manual exports.

B: A device proactively sends an asynchronous event notification to a manager. However, it does not most directly satisfy the requirement in this scenario: integrate a monitoring platform with another system without manual exports.

C: Correlates security/event data and applies detection/analytics across collected logs. However, it does not most directly satisfy the requirement in this scenario: integrate a monitoring platform with another system without manual exports.

D: Defines managed objects and identifiers that SNMP managers can query. However, it does not most directly satisfy the requirement in this scenario: integrate a monitoring platform with another system without manual exports.

E: Copies switch traffic from selected ports/VLANs to an analysis port. However, it does not most directly satisfy the requirement in this scenario: integrate a monitoring platform with another system without manual exports.

Learning point: Use API integration when the key requirement is to integrate a monitoring platform with another system without manual exports.

Question 12

For a new deployment at Contoso Health, the networking team wants to maintain an inventory of currently reachable network devices. Which choice most directly satisfies the goal? The decision applies to a remote-site migration.

1. Availability monitoring
2. Network discovery
3. Configuration monitoring
4. Flow data
5. Packet capture

Correct answer: B

Why: Finds devices and services on the network through scans or scheduled discovery. This directly satisfies the requirement: maintain an inventory of currently reachable network devices.

Option review:

A: Checks whether services/devices remain reachable and responsive. However, it does not most directly satisfy the requirement in this scenario: maintain an inventory of currently reachable network devices.

B: Finds devices and services on the network through scans or scheduled discovery. This directly satisfies the requirement: maintain an inventory of currently reachable network devices.

C: Tracks configuration state and changes to identify unauthorized drift. However, it does not most directly satisfy the requirement in this scenario: maintain an inventory of currently reachable network devices.

D: Summarizes conversations/traffic metadata such as sources, destinations, ports, and byte counts. However, it does not most directly satisfy the requirement in this scenario: maintain an inventory of currently reachable network devices.

E: Records full packets for protocol-level inspection and troubleshooting. However, it does not most directly satisfy the requirement in this scenario: maintain an inventory of currently reachable network devices.

Learning point: Use Network discovery when the key requirement is to maintain an inventory of currently reachable network devices.

Question 13

At Litware Manufacturing, a systems administrator is reviewing a network change. The requirement is to alert the NOC when network behavior becomes abnormal. Which option is the best fit? The decision applies to a operations lab.

1. SNMP trap
2. Network discovery
3. API integration
4. Baseline metrics
5. Anomaly alerting

Correct answer: E

Why: Notifies operators when observed behavior deviates from defined thresholds or learned baselines. This directly satisfies the requirement: alert the NOC when network behavior becomes abnormal.

Option review:

A: A device proactively sends an asynchronous event notification to a manager. However, it does not most directly satisfy the requirement in this scenario: alert the NOC when network behavior becomes abnormal.

B: Finds devices and services on the network through scans or scheduled discovery. However, it does not most directly satisfy the requirement in this scenario: alert the NOC when network behavior becomes abnormal.

C: Allows monitoring or automation systems to exchange data programmatically. However, it does not most directly satisfy the requirement in this scenario: alert the NOC when network behavior becomes abnormal.

D: Establish normal performance levels so deviations can be recognized. However, it does not most directly satisfy the requirement in this scenario: alert the NOC when network behavior becomes abnormal.

E: Notifies operators when observed behavior deviates from defined thresholds or learned baselines. This directly satisfies the requirement: alert the NOC when network behavior becomes abnormal.

Learning point: Use Anomaly alerting when the key requirement is to alert the NOC when network behavior becomes abnormal.

Question 14

A ticket at Woodgrove Bank says the team must detect outages or service unavailability quickly. Which technology or concept most directly addresses this requirement? The decision applies to a production maintenance window.

1. Flow data
2. Availability monitoring
3. Anomaly alerting
4. Baseline metrics
5. Packet capture

Correct answer: B

Why: Checks whether services/devices remain reachable and responsive. This directly satisfies the requirement: detect outages or service unavailability quickly.

Option review:

A: Summarizes conversations/traffic metadata such as sources, destinations, ports, and byte counts. However, it does not most directly satisfy the requirement in this scenario: detect outages or service unavailability quickly.

B: Checks whether services/devices remain reachable and responsive. This directly satisfies the requirement: detect outages or service unavailability quickly.

C: Notifies operators when observed behavior deviates from defined thresholds or learned baselines. However, it does not most directly satisfy the requirement in this scenario: detect outages or service unavailability quickly.

D: Establish normal performance levels so deviations can be recognized. However, it does not most directly satisfy the requirement in this scenario: detect outages or service unavailability quickly.

E: Records full packets for protocol-level inspection and troubleshooting. However, it does not most directly satisfy the requirement in this scenario: detect outages or service unavailability quickly.

Learning point: Use Availability monitoring when the key requirement is to detect outages or service unavailability quickly.

Question 15

During a design meeting at Blue Yonder Airlines, the junior network administrator needs to detect when a router or switch configuration changes unexpectedly. What should be selected? The decision applies to a new floor deployment.

1. SNMP polling
2. Configuration monitoring
3. Baseline metrics
4. Packet capture
5. Port mirroring

Correct answer: B

Why: Tracks configuration state and changes to identify unauthorized drift. This directly satisfies the requirement: detect when a router or switch configuration changes unexpectedly.

Option review:

A: A manager queries device MIB objects to collect status and performance information. However, it does not most directly satisfy the requirement in this scenario: detect when a router or switch configuration changes unexpectedly.

B: Tracks configuration state and changes to identify unauthorized drift. This directly satisfies the requirement: detect when a router or switch configuration changes unexpectedly.

C: Establish normal performance levels so deviations can be recognized. However, it does not most directly satisfy the requirement in this scenario: detect when a router or switch configuration changes unexpectedly.

D: Records full packets for protocol-level inspection and troubleshooting. However, it does not most directly satisfy the requirement in this scenario: detect when a router or switch configuration changes unexpectedly.

E: Copies switch traffic from selected ports/VLANs to an analysis port. However, it does not most directly satisfy the requirement in this scenario: detect when a router or switch configuration changes unexpectedly.

Learning point: Use Configuration monitoring when the key requirement is to detect when a router or switch configuration changes unexpectedly.

Question 16

During a data-center segment, Contoso Health is comparing several networking concepts. Which option is accurately characterized by this statement: A manager queries device MIB objects to collect status and performance information.

1. Baseline metrics
2. SNMP polling
3. SNMPv3
4. Availability monitoring
5. Network discovery

Correct answer: B

Why: A manager queries device MIB objects to collect status and performance information. This directly satisfies the requirement: A manager queries device MIB objects to collect status and performance information..

Option review:

A: Establish normal performance levels so deviations can be recognized. However, it does not most directly satisfy the requirement in this scenario: A manager queries device MIB objects to collect status and performance information..

B: A manager queries device MIB objects to collect status and performance information. This directly satisfies the requirement: A manager queries device MIB objects to collect status and performance information..

C: Adds authentication and encryption capabilities absent from community-string-only deployments. However, it does not most directly satisfy the requirement in this scenario: A manager queries device MIB objects to collect status and performance information..

D: Checks whether services/devices remain reachable and responsive. However, it does not most directly satisfy the requirement in this scenario: A manager queries device MIB objects to collect status and performance information..

E: Finds devices and services on the network through scans or scheduled discovery. However, it does not most directly satisfy the requirement in this scenario: A manager queries device MIB objects to collect status and performance information..

Learning point: Use SNMP polling when the key requirement is to collect interface counters and device statistics on a schedule.

Question 17

During a remote-site migration, Litware Manufacturing is comparing several networking concepts. Which option is accurately characterized by this statement: A device proactively sends an asynchronous event notification to a manager.

1. Flow data
2. SNMP trap
3. SNMP polling
4. Anomaly alerting
5. Log aggregation

Correct answer: B

Why: A device proactively sends an asynchronous event notification to a manager. This directly satisfies the requirement: A device proactively sends an asynchronous event notification to a manager..

Option review:

A: Summarizes conversations/traffic metadata such as sources, destinations, ports, and byte counts. However, it does not most directly satisfy the requirement in this scenario: A device proactively sends an asynchronous event notification to a manager..

B: A device proactively sends an asynchronous event notification to a manager. This directly satisfies the requirement: A device proactively sends an asynchronous event notification to a manager..

C: A manager queries device MIB objects to collect status and performance information. However, it does not most directly satisfy the requirement in this scenario: A device proactively sends an asynchronous event notification to a manager..

D: Notifies operators when observed behavior deviates from defined thresholds or learned baselines. However, it does not most directly satisfy the requirement in this scenario: A device proactively sends an asynchronous event notification to a manager..

E: Centralizes logs from many devices for search, retention, and correlation. However, it does not most directly satisfy the requirement in this scenario: A device proactively sends an asynchronous event notification to a manager..

Learning point: Use SNMP trap when the key requirement is to receive immediate device-generated alerts without waiting for the next poll.

Question 18

During a operations lab, Woodgrove Bank is comparing several networking concepts. Which option is accurately characterized by this statement: Adds authentication and encryption capabilities absent from community-string-only deployments.

1. API integration
2. Flow data
3. SNMPv3
4. MIB
5. Anomaly alerting

Correct answer: C

Why: Adds authentication and encryption capabilities absent from community-string-only deployments. This directly satisfies the requirement: Adds authentication and encryption capabilities absent from community-string-only deployments..

Option review:

A: Allows monitoring or automation systems to exchange data programmatically. However, it does not most directly satisfy the requirement in this scenario: Adds authentication and encryption capabilities absent from community-string-only deployments..

B: Summarizes conversations/traffic metadata such as sources, destinations, ports, and byte counts. However, it does not most directly satisfy the requirement in this scenario: Adds authentication and encryption capabilities absent from community-string-only deployments..

C: Adds authentication and encryption capabilities absent from community-string-only deployments. This directly satisfies the requirement: Adds authentication and encryption capabilities absent from community-string-only deployments..

D: Defines managed objects and identifiers that SNMP managers can query. However, it does not most directly satisfy the requirement in this scenario: Adds authentication and encryption capabilities absent from community-string-only deployments..

E: Notifies operators when observed behavior deviates from defined thresholds or learned baselines. However, it does not most directly satisfy the requirement in this scenario: Adds authentication and encryption capabilities absent from community-string-only deployments..

Learning point: Use SNMPv3 when the key requirement is to monitor devices using the most secure SNMP version listed.

Question 19

During a production maintenance window, Blue Yonder Airlines is comparing several networking concepts. Which option is accurately characterized by this statement: Defines managed objects and identifiers that SNMP managers can query.

1. MIB
2. Anomaly alerting
3. Port mirroring
4. Flow data
5. Baseline metrics

Correct answer: A

Why: Defines managed objects and identifiers that SNMP managers can query. This directly satisfies the requirement: Defines managed objects and identifiers that SNMP managers can query..

Option review:

A: Defines managed objects and identifiers that SNMP managers can query. This directly satisfies the requirement: Defines managed objects and identifiers that SNMP managers can query..

B: Notifies operators when observed behavior deviates from defined thresholds or learned baselines. However, it does not most directly satisfy the requirement in this scenario: Defines managed objects and identifiers that SNMP managers can query..

C: Copies switch traffic from selected ports/VLANs to an analysis port. However, it does not most directly satisfy the requirement in this scenario: Defines managed objects and identifiers that SNMP managers can query..

D: Summarizes conversations/traffic metadata such as sources, destinations, ports, and byte counts. However, it does not most directly satisfy the requirement in this scenario: Defines managed objects and identifiers that SNMP managers can query..

E: Establish normal performance levels so deviations can be recognized. However, it does not most directly satisfy the requirement in this scenario: Defines managed objects and identifiers that SNMP managers can query..

Learning point: Use MIB when the key requirement is to identify which device variables and OIDs are available for SNMP monitoring.

Question 20

During a new floor deployment, Contoso Health is comparing several networking concepts. Which option is accurately characterized by this statement: Summarizes conversations/traffic metadata such as sources, destinations, ports, and byte counts.

1. Flow data
2. Network discovery
3. Port mirroring
4. Availability monitoring
5. SNMP polling

Correct answer: A

Why: Summarizes conversations/traffic metadata such as sources, destinations, ports, and byte counts. This directly satisfies the requirement: Summarizes conversations/traffic metadata such as sources, destinations, ports, and byte counts..

Option review:

A: Summarizes conversations/traffic metadata such as sources, destinations, ports, and byte counts. This directly satisfies the requirement: Summarizes conversations/traffic metadata such as sources, destinations, ports, and byte counts..

B: Finds devices and services on the network through scans or scheduled discovery. However, it does not most directly satisfy the requirement in this scenario: Summarizes conversations/traffic metadata such as sources, destinations, ports, and byte counts..

C: Copies switch traffic from selected ports/VLANs to an analysis port. However, it does not most directly satisfy the requirement in this scenario: Summarizes conversations/traffic metadata such as sources, destinations, ports, and byte counts..

D: Checks whether services/devices remain reachable and responsive. However, it does not most directly satisfy the requirement in this scenario: Summarizes conversations/traffic metadata such as sources, destinations, ports, and byte counts..

E: A manager queries device MIB objects to collect status and performance information. However, it does not most directly satisfy the requirement in this scenario: Summarizes conversations/traffic metadata such as sources, destinations, ports, and byte counts..

Learning point: Use Flow data when the key requirement is to analyze who is talking to whom without storing full packet payloads.