rcsp cascade 299-01

Riverbed 299-01

Riverbed Certified Solutions ProfessionalNetwork Performance Management

Version: 5.0

Topic 1, Volume A

QUESTION NO: 1

When creating an analytic service, the discovery process requires a minimum of:

A. At least three days of data available. B. At least three weeks of data available. C. The application specialist available. D. Some historical data and some starting point (a server, port, application). E. A customer network diagram available.

Answer: DExplanation:

QUESTION NO: 2

Link Congestion policies apply to a specific interface and can: (Select 3)

A. Warn if either inbound or outbound traffic increases abnormally B. Warn if an application component of traffic increases abnormally C. Warn if traffic to/from specific hosts exceeds a specific utilization level D. Warn if the response time across a link increases abnormally

Answer: A,B,CExplanation:

QUESTION NO: 3

If a VLAN SPAN (VLAN101) is configured and monitored by Cascade Shark, which of thefollowing is true? (Select 2)

A. Inter VLAN101 traffic will be monitored; Intra VLAN101 traffic will not. B. Intra VLAN101 traffic will be monitored; Inter VLAN101 traffic will not. C. Both inter and intra VLAN101 traffic will be monitored. D. It is a best practice to configure the Cascade Shark monitoring port (the SPAN destination) with'deduplication' enabled. E. It is a best practice to configure the Cascade Shark monitoring port (the SPAN destination)without 'deduplication' enabled.

Answer: C,D

Riverbed 299-01 Exam

RCSP - Network Performance Management - Version: 5.0 2

Explanation:

QUESTION NO: 4

Quality of Service information is obtained from what Cascade sources?

A. Cascade Sensor only B. Cannot get QoS data on Cascade C. Cascade Sensor and Cascade Gateway D. CascadeFlow traffic only E. NetFlow and IPFIX traffic only

Answer: CExplanation:

QUESTION NO: 5

Cascade Profiler provides identity information collected from Active Directory 2008 by installingand correctly configuring the 'Cascade Connector' agent software on:

A. Every DNS server in the AD environment B. Any server in the MS domain C. Every client desktop in the AD environment D. Every NTP server in the MS domain E. The Microsoft Event Collector component in the AD environment

Answer: EExplanation:

QUESTION NO: 6

Which of the following statements is true regarding SNMP polling and NTP syncing amongCascade components?

A. Cascade Gateway's poll via SNMP sources of Netflow, while Cascade Profiler, CascadeGateway and Cascade Sensor sync NTP from a common source. B. Cascade Profiler's poll via SNMP sources of Netflow, while Cascade Profiler, CascadeGateway and Cascade Sensor sync NTP from a common source.



C. Cascade Profiler, Cascade Gateway and Cascade Sensor sync NTP from different sources,while Cascade Profiler's poll via SNMP sources of Netflow. D. Cascade Profiler, Cascade Gateway and Cascade Sensor sync NTP from different sources,while Cascade Gateway's poll via SNMP sources of Netflow. E. Cascade Profiler does all SNMP polling and is also the source of all NTP.


QUESTION NO: 7

Within Cascade Pilot, to analyze the round-trip time in a trace file, you can:

A. Ask Riverbed Support to send you the proper View to use. B. Open the View folders in Cascade Pilot to look for a View named "Round-trip time". C. Use the View search box and enter "round". D. Use the Help menu and search for round.


QUESTION NO: 8

For DNS reverse lookup, Cascade Profiler caches as follows:

A. Cache the most recent 500 IPs. B. Obey DNS TTLs. C. Cascade does not cache DNS responses. D. For 24 hours.


QUESTION NO: 9

What are two differences between NetFlow version 5 and NetFlow version 9 (select 2)

A. NetFlow version 5 generally support ingress flow export only; NetFlow version 9 supports both



ingress and egress export. B. NetFlow version 5 is used for Switches, NetFlow version 9 is used for Routers. C. NetFlow version 9 includes information about CPU, Power-status and other router performancecharacteristics; NetFlow version 5 does not. D. NetFlow version 9 includes the ability to export the Time-To-Live (TTL); NetFlow version 5 doesnot. E. NetFlow version 9 includes the ability to export the packet latency, NetFlow version 5 does not.

Answer: A,DExplanation:

QUESTION NO: 10

When changing the priority for a Layer 4 mapping on Cascade Profiler best practices indicate thatApplication Mappings should be given higher priorities based on:

A. Longest Match B. Shortest Match C. IP & Port D. IP

Answer: AExplanation:

QUESTION NO: 11

What is the relationship between a Host Group and a Host Group Type in Cascade Profiler?

A. A Host Group Type is a container that may contain multiple Host Groups. B. A Host Group Type defines the name of the Host Group. C. They are the same thing. D. Each Host Group must be defined by the Type of application it serves; this is the Host GroupType.


QUESTION NO: 12



Cascade Profiler's Switch Integration feature uses SNMP and adds the capability for Cascade toreport on which of the followinG. (Select 2)

A. User name B. Host IP address C. Host MAC address D. The physical switch port a specific host is connected to E. Switch port traffic levels F. Switch port status G. SNMP traps from the switch

Answer: C,DExplanation:

QUESTION NO: 13

What are the two types of dashboards available within the Cascade Profiler GUI? (select 2)

A. Top Hosts B. Top Applications C. Public D. Private E. Devices and Interfaces Utilization


QUESTION NO: 14

If unable to connect to the Cascade Shark Appliance from the Cascade Pilot console it could bebecausE. (Select 2)

A. The correct communication port(s) are NOT open on the firewall between Cascade Pilot andCascade Shark. B. The Cascade Shark is placed in "passthru" mode so Cascade Pilot access is not available C. The Cascade Shark appliance has no capture jobs configured. D. You may be running Cascade Pilot-Personal-Edition (PE). You need the full version of CascadePilot to connect to Cascade Shark. E. Trend/Index data is disabled on the Cascade Shark Appliance.




QUESTION NO: 15

What is a good way to know whether all internal IP addresses seen by the Cascade Profiler havebeen grouped in a particular group type?

A. Run Automatic grouping for all group types. B. Configure an Undefined group type with definition 0.0.0.0/0; confirm there are no entries whenyou 'view members' of this 'Undefined' group'. C. There is no way to do this and successfully capture all the IP addresses. D. Configure an Undefined group type with definition 0.0.0.0/32. E. Run a report by hosts and look for undefined groups.

Answer: BExplanation:

QUESTION NO: 16

How do Cascade Performance Analytics assist with Performance Monitoring?

A. By setting intelligent static thresholds for Application metrics and Interface metrics, tolerancecan be determined. Cascade will use these thresholds and tolerances to report on deviationsindicative of performance problems. B. The Customer only needs to identify their critical hosts, interfaces and/or applications, andCascade will automatically baseline their behavior and report on deviations indicative ofperformance problems. C. The Performance Analytics use knowledge of hosts, interfaces, and/or applications are able todetect security threats such as host scans and worms. D. After baselining is completed, Cascade can re-route congested traffic to avoid congestedapplication delivery paths.


QUESTION NO: 17



When editing a previously configured service policy, what options become available if you click the'show advanced settings' checkbox? (Select 3)

A. Allows enabling/disabling the detection of dips in the metric. B. Allows tuning of the tolerance range of the metric. C. Allows setting of a noise floor for the metric. D. Allows adjusting the notifications for the metric. E. Allows enabling/disabling the detection of spikes in the metric.

Answer: A,C,EExplanation:

QUESTION NO: 18

Which of the following configuration changes can be used to reduce the number of alertsgenerated overall for a Service?

A. Edit each Service policy to increase the Tolerance slider for Low and High alerts. B. Edit each Service policy and set a noise floor to specify the minimum amount of change that thepolicy can treat as deviation from normalbehavior. C. Edit the Service and select fewer metrics to monitor for each segment that comprises theService. D. Modify the location host group type used for monitoring end user traffic to use fewer groups (forexample, Region instead of Site). E. A, B, C, and D. F. A and B only.


QUESTION NO: 19

If a report table on Cascade Profiler includes the "Server Delay" column but shows no value for"Server Delay" in some cells, what are the possible causes? (Select 3)

A. The time span of the report does not cover any connection set-up points B. Server delay is zero. C. The protocol used by the application in not TCP-based. D. Application traffic was not seen by a Cascade Sensor. E. The server plug-in is needed to measure "Server Delay" and not functioning correctly.



Answer: A,C,DExplanation:

QUESTION NO: 20

Within the Cascade Pilot GUI, filtered items are often indicated:

A. With red text. B. With yellow text. C. With a funnel icon. D. With a hash-mark icon.


QUESTION NO: 21

Which of the following metrics are monitored in an Application Performance Policy? (Select 4)

A. Increase in Server Delay B. Decrease in Average Connection Application-level Throughput C. Increases in the number of TCP retransmissions D. Decreases in the number of new connections to the application servers E. Increase in the number of Active Connections

Answer: B,C,D,EExplanation:

QUESTION NO: 22

What are the two (at a minimum) devices you need to configure in Cascade Profiler for Switch PortDiscovery integration to work for a portion of the network?

A. At least one NetFlow sources (router, switch, or steelhead). B. At least one lookup router and at least one access tier switch. C. A Vulnerability Scanner and a Netflow source (router, switch, or steelhead). D. A Vulnerability Scanner and an External Link.




QUESTION NO: 23

Which fields are generally available for export using NetFlow technology?

A. IP Addresses, Port Numbers, Protocol, TCP Flags, DSCP Marking, number of bits, number ofpackets, retransmitted bits B. IP Addresses, Port Numbers, Protocol, TCP Flags, DSCP Marking, number of bits, number ofpackets, inbound/outbound interface ID C. IP Addresses, MAC Addresses, Port Numbers, Protocol, DSCP Marking, number of bits,number of packets D. IP Addresses, Port Numbers, Protocol, Round Trip Time, DSCP Marking, number of bits,number of packets E. IP Addresses, Port Numbers, Protocol, Packet Latency, DSCP Marking, number of bits, numberof packets


QUESTION NO: 24

In Cascade Profiler, what is the minimum amount of historical flow data required for an ApplicationPerformance analytic to initialize?

A. Three weeks B. Three days C. One day D. Configurable from one minute to three weeks


QUESTION NO: 25

In this scenario, you have created a host group called My_Computers on Cascade Profiler. In thatgroup you have included the subnet 192.168.1.0/25.



You have 10 devices in that group 192.168.1.1-10. The rest of the addresses are unused. Whilerunning reports on this segment of the network you notice that when a report is run using the entire subnet you see traffic destined for 192.168.1.120. When you run the same report specifyingthe host group the traffic does not appear. Why is this happening?

A. 192.168.1.120 is not in the 192.168.1.0/25 subnet B. 192.168.1.120 has been input as a trusted host in a security policy C. Traffic to 192.168.1.120 was not picked up by a Sensor D. Traffic to 192.168.1.120 was not picked up by a Gateway E. 192.168.1.120 never sent any traffic


QUESTION NO: 26

In the Cascade Profiler GUI, what is a Port Group?

A. A combination of IP Address and Port Number B. One or more protocol/port combinations mapped to a name C. Names mapped to IP subnets D. Layer-2 switch ports grouped into a logical name E. NetFlow interfaces grouped into a logical name


QUESTION NO: 27

In order to analyze data captured by a Cascade Shark appliancE. (Select 3)

A. You can connect directly to the Cascade Shark with Cascade Pilot to begin analysis. B. You can connect directly to the Cascade Shark with Cascade Gateway to begin analysis. C. You can start analysis on the Cascade Profiler based upon flow data that has been sent fromCascade Shark to Cascade Profiler. D. You can export data from a capture job directly to a packet capture (pcap) file and open in anytool that accepts pcap format. E. You can start by loading views of the data from the Cascade Shark Appliance Web GUI beforeexport to Wireshark.




QUESTION NO: 28

How do I run a report on Cascade Profiler to show all hosts that have talked to server"192.168.1.100" on TCP port 25?

A. Under the traffic reports Advanced Tab, place "192.168.1.100" in the Host field select "Actingas Server" in the drop down, enter "tcp/25" in the Protocol field and select "Hosts" in the "report-by" pull down. B. Under the traffic reports Advanced Tab, place "192.168.1.100" in the Host field select "Actingas Server" in the drop down, enter "tcp/25" in the Protocol field and select "Peers Hosts" in the"report-by" pull down. C. Under the traffic reports Advanced Tab, place "192.168.1.100" in the Host field select "Actingas Client and Server" in the drop down, enter "tcp-25" in the Protocol field and select "Hosts" in the"report-by" pull down. D. Under the "Quick Reports" pull down from the dashboard page, select "Host" enter the IPAddress and hit return.


QUESTION NO: 29

Which of the following are TRUE concerning packet capture jobs on the Cascade SharkappliancE. (Select 4)

A. Packets can be captured from multiple capture ports on one Cascade Shark appliance. B. The maximum length the packet data can be specified. C. Packets can be filtered on host IP addresses. D. SSL traffic can be decoded if the appropriate certificate are loaded in the Cascade Sharkappliance. E. The maximum storage bandwidth for the job can be specified in bits/sec. F. Multiple packet capture jobs can run concurrently.

Answer: A,B,C,FExplanation:



QUESTION NO: 30

An interactive view within Cascade Pilot:

A. Can be created from a single applied View. B. Can work on local trace files only. C. Can include more than two charts. D. Is not available in the regular Cascade Pilot installation.


QUESTION NO: 31

What does Cascade use as the flow key to identify a unique flow?

A. sourceIP, destIP, protocol, sourcePort, destPort, QoS B. sourceIP, destIP, protocol, destPort C. sourceIP, destIP, protocol, sourcePort, destPort D. destIP, protocol, destPort E. sourceIP, destIP, protocol


QUESTION NO: 32

Trace clips in Cascade Pilot allow you to:

A. Save a time window to a trace file for post-capture analysis. B. Save a time window and apply Views to analyze a portion of a Capture Job. C. Analyze an indexed capture job with Views that support indexing. D. Clip a trace file to your desktop.


QUESTION NO: 33



When saving a new application performance analytic on Cascade Profiler, which of the following istrue?

A. You must have at least three days of history of 15 minute rollups before saving the analytic. B. You must have at least three days of history of 15 minute rollups before the analytic initializes. C. If you include all possible metrics, but there is no possibility of measuring response time due tolack of Sensor coverage, the analytic will fail to initialize. D. The analytic will not alert for a minimum of 1 week during baseline collection. E. Both B and C.


QUESTION NO: 34

On Cascade Profiler, Which of the following account role permissions is not unique toadministrator accounts?

A. Creating or modifying custom host groups. B. Grant other users the ability to run user reports. C. Set or modify passwords for other users. D. View the audit trail page. E. Specify mitigation actions.


QUESTION NO: 35

A user wants to use the link congestion analytic policy on Cascade Profiler to monitor five keyWAN links for an increase in traffic outside of the expected traffic that includes TCP/80, TCP/443,TCP25, and UDP/53. Can the link congestion policy be used for this scenario?

A. No, because a link analytic can monitor only a single interface. B. Yes, one can define separate link congestion analytic policies for each WAN interface. C. No, because one can only define specific ports to include on a link congestion policy. D. Yes, because one can define a port group that includes every UDP and TCP port except forthose that include the expected traffic, and that port group can be used for the link congestionanalytic policy. E. No, and both A and C include valid reasons.




QUESTION NO: 36

When analyzing a large (100GB, for example) trace file within Cascade Pilot, you should:

A. Copy the file onto a Cascade Shark to ensure better performance. B. Create an index so that processing of the View analytics will be faster. C. Apply a View with a specific filter. D. Use Wireshark tools to split the trace file in multiple and smaller trace files.


QUESTION NO: 37

Which of the following is a valid group definition on Cascade Profiler? (Select 4)

A. 10.0.0.0/23 United_States B. 0.0.0.0/0.0.0.0 Worldwide C. 24.32.8.43/32 CEO_Printer D. 192.168.0.5/255.0.255.0 Printers E. 10.38.14.1/255.255.255.255 My Computer

Answer: A,B,C,DExplanation:

QUESTION NO: 38

What is a benefit that Cascade Profiler might provide to Security Operations? (Select 3)

A. Ability to identify Scanners and Worm Propagations. B. Ability to provide information for a firewall rule when a user defined policy is violated. C. Ability to alert on security policy (e.g. an insecure policies, such as FTP, is in use). D. Ability to identify Worms by name.

Answer: A,B,C



Explanation:

QUESTION NO: 39

A system administrator needs to update their Cascade Profiler host group settings to removereferences to a decommissioned office on the 10.63.32.0/24 subnet.

What is the best way to do this?

A. echo "delete from hostinfo where ipaddr = '10.63.32.0/24';" | psql mazu postgres B. Edit the Definition and remove the entry for 10.63.32.0/24 Bracknell_UK C. echo "delete from hostinfo where group = 'Bracknell_UK;" | psql mazu postgreswrite_community_string D. Go to Host Groups and insert " #10.63.32.0/24 Bracknell_UK"


QUESTION NO: 40



Why should all flow exporting devices use the same NTP (Network Time Protocol ) source?

A. Ensures Cascade is able to recreate the packets. B. Essential for the flow de-duplication process. C. Ensures the flow is delivered to the correct Gateway. D. All of the above. E. None of the above.


QUESTION NO: 41

The "Policies Usage" that is reported under System Information pertains to which of thefollowing:

A. All Service-based application performance policies B. All Service-based policies plus all Performance and Availability analytic policies C. All Service-based policies plus all Performance and Availability analytic policies plus all User-Defined Policies D. All Service-based policies plus all Performance and Availability analytic policies plus all User-Defined Policies plus all Security policies E. None of the above


QUESTION NO: 42

Which of the following capabilities are supported by the Cascade Sensor appliance but are notsupported by the Cascade Sensor-VE RSP packagE. (Select 2)

A. Network Round Trip measurement B. Packet logging C. Server Delay measurement D. Connection Throughput measurement E. Retransmission measurement F. L7 application fingerprint checking

Answer: B,F



Explanation:

QUESTION NO: 43

When you modify a filter in Cascade Pilot:

A. Changes are saved only in the View to which the filter has been applied. B. The modified filter is saved on the machine on which Cascade Pilot is running. C. The modified filter is saved on any Cascade Shark that Cascade Pilot is connected to. D. The changes are lost when you close Cascade Pilot.


QUESTION NO: 44

Which of the following types of hosts are included in Cascade grouping on Cascade Profiler?

A. Internal hosts only B. External hosts only C. All hosts D. Internal and External hosts only E. Specified internal hosts plus the non-routable subnets


QUESTION NO: 45

Live interfaces within Cascade Pilot as shown in the sources panel devices tab include:

A. Local interfaces, Cascade Shark port interfaces, Cascade Shark aggregating port interfaces,and virtual interfaces associated with capture job traces. B. Local interfaces, Cascade Shark port interfaces, Cascade Shark aggregating port interfaces,and virtual interfaces associated with trace clips. C. Local interfaces ONLY. Cascade Shark port interfaces must be viewed from the remote menu. D. Interfaces associated with Cascade Shark ports ONLY. Local interfaces must be viewed fromthe local menu.




QUESTION NO: 46

When links in a network are using WAN optimization, it is best if the Cascade Profiler or Expressreceives data from a _________or _________ monitoring traffic on the LAN side of the Steelheadthat is located on the server side of the optimized connection. This is necessary in order todetermine server delay.

(Select 2)

A. Cascade Shark B. Router C. Layer 3 switch D. Steelhead appliance E. Cascade Sensor

Answer: A,EExplanation:

QUESTION NO: 47

Which content block can be used to compare traffic between two time periods on the CascadeProfiler Dashboard?

A. Watched list as a bar chart B. Watched list as a stacked area chart C. Watched list as a line graph D. Watched list as a pie chart E. Top list as a bar chart


QUESTION NO: 48

On Cascade Profiler, in terms of retention of completed reports and reporting sources (one minuteflow and rollup files), which of the following is true? (Select 4)



A. One minute flow records are deleted from the file system FIFO (oldest first) once the appliancehas filled the space that is allocated. B. There is a fixed amount of space on the filesystem for completed reports. C. A report template can be marked "keep until I delete it" so that any reports that are scheduledwith this template are not automatically deleted from the filesystem. D. When the flows or rollup records have been deleted from the filesystem, any saved report thatwas generated from those flow sources is no longer available. E. Users have the ability to allocate additional space to the 1 min flow logs in order to increaseretention. This is done at the expense of other rollup resolutions.

Answer: A,B,C,EExplanation:

QUESTION NO: 49

The Discovery Wizard has been used to map a complex application to be monitored by Cascade'sservice monitoring for a company with 25 remote locations and one data center, each defined as agroup within the group type used. There are two front-end segments to signify incoming end userconnections, and 15 back-end connections among all of the servers. The only metric/policyactivated for each segment is the 'Response Time' metric. How many policies on the CascadeProfiler will this service consume?

A. 40 B. 65 C. 17 D. 55 E. 425


QUESTION NO: 50

What is the maximum limit of configurable flows that can be exported from the Cascade Sharkappliance? (Select 2)

A. 200,000 flows per minute per port B. 300,000 flows per minute per port C. 500,000 flows per minute per port D. 500,000 flows per minute total E. 600,000 flows per minute total



Answer: C,EExplanation:

QUESTION NO: 51

Within Cascade Profiler you can set the recipient for policy notifications under Advancedconfiguration to:

A. Log Only, SNMP Only, Email Only, SNMP and Email B. Log Only, Default, Owner, or any defined recipient C. Log Only, Default, Owner or any User Account D. Log Only, Default, Owner or any User Name obtained via the Identity Integration


QUESTION NO: 52

Which of the following are available integrations for Cascade Profiler? (Select 3)

A. SNMP to send traps to trap receivers. B. SNMP to discover switch ports associated with IP addresses. C. SNMP to discover router interface capacities. D. SNMP to discover router CPU utilization.


QUESTION NO: 53

Which of the following best describes any limits that are enforced on the number of service,performance and availability policies that are supported on any Cascade Profiler?

A. Stratified policy limits ranging from 5000 for Cascade Profiler Express platforms to 10,000 forCascade Enterprise Profiler platforms B. 5,000 for all platforms C. 15,000 for all platforms D. The Analytics license provides for an unlimited number of policies



E. None of the above


QUESTION NO: 54

What mechanism does Cascade Profiler use to identify the switch port a host is attached to andthe hosts associated MAC address?

A. SNMP traps from the switches and routers B. NetFlow v9 C. SNMP polling of the switches and routers D. All of the above E. None of the above


QUESTION NO: 55

What report on Cascade Profiler would be used to show both sides of a conversation and the portsthey communicated on?

A. Peers B. Peers and Ports C. Host Pairs D. Ports E. Host Pairs and Ports


QUESTION NO: 56

In the Cascade Profiler Dashboard GUI, what types of content blocks can you create? (Select 4)

A. Watched items (where items are hosts, interface, etc.)



B. Top items (where items are hosts, interface, etc.) C. Top usernames D. Unacknowledged Events E. Current Events F. Last Day Events

Answer: A,B,D,EExplanation:

QUESTION NO: 57

Which version of SNMP traps can the Cascade Profiler and Cascade Express send?

A. SNMPv1 Only B. SNMPv2 Only C. SNMPv1 and SNMPv2 D. SNMPv1 and SNMPv3


QUESTION NO: 58

When working with capture job traces on a Cascade Shark appliance from Cascade Pilot:

A. Views should always be applied directly to the job trace. B. Trace clips should first be created, and views applied to them. C. Packets should be exported from the capture job trace before beginning analysis. D. The capture job trace should first be indexed by right-clicking on it and selecting "Index".


QUESTION NO: 59

Cascade Profiler is reporting the traffic on Steelhead optimized flows separately than theconnections on tcp/7800 between two Steelheads. In other words, from Cascade you see flows fortraffic on various ports used natively by the clients and servers across the steelhead as well asflows for tcp/7800. What does this indicate?



A. This is normal in optimization environments and provides the proper reporting of traffic volumebetween locations. B. This indicates that Flow data is being reported on the optimized connection, betweenSteelheads and has no impact on reporting. C. This indicates that Flow data is being reported on the optimized connection, betweenSteelheads and can lead to Cascade double-counting volumes between locations. D. This cannot happen.


QUESTION NO: 60

In the Cascade Profiler GUI, where can you mark a TCP port as a Server Port?

A. Definitions->Host Groups B. Definitions->Applications C. Definitions->Port Names D. Definitions->Port Groups E. Integration->Switch Port Discovery


QUESTION NO: 61

In defining a user defined policy on Cascade Profiler that triggers when the aggregate connectionrate from any internal host to all external hosts exceeds a certain threshold, one has entered"within internal" for host/group A and "outside internal" for host/group B. How should the statisticsbe tracked for host/group A and B?

A. host/group A "Track in aggregate" host/group B "track per host". B. host/group A "track per host" host/group B "track in aggregate". C. host/group A "track in aggregate" host/group B "track in aggregate". D. host/group A "track per user" host/group B "track per user". E. a user defined policy cannot support this scenario because it involves tracking traffic to externalhosts.




QUESTION NO: 62

How does Cascade Profiler obtain switch port discovery and population information?

A. Switch Port Discovery Protocol (SPDP) B. Merging of CAM + ARP tables, both gathered via SNMP C. Merging of IF and ARP tables, both gathered via SNMP D. Merging of IF and CAM tables, both gathered via SNMP


QUESTION NO: 63

Some common protocols which may be observed on a network with visibility tools are listed below. Match the protocol name with the most common port used.

1. HTTP a) TCP/252. HTTPS b) TCP/4453. HTTPS through a proxy c) TCP/4434. SMTP d) TCP/805. CIFS e) TCP/8080

A. 1-d; 2-b; 3-c; 4-a; 5-b B. 1-e; 2-c; 3-d; 4-a; 5-b C. 1-d; 2-c; 3-e; 4-b; 5-a D. 1-d; 2-c; 3-e; 4-a; 5-b E. 1-e; 2-d; 3-c ; 4-b; 5-a


QUESTION NO: 64

How many Host Group Types can be tracked on the Dashboard within the Cascade Profiler GUI?



A. Unlimited B. Ten C. Four D. Twenty


QUESTION NO: 65

What is the maximum number of custom applications (Layer 4 and 7 combined) permitted to bedefined on a single Cascade Profiler?

A. 50 B. 75 C. 100 D. 125 E. Unlimited


QUESTION NO: 66

A packet capture (pcap) file that is loaded into Cascade Pilot for the first time is indexed:

A. When the file is opened in Cascade Pilot for analysis. B. When the file is imported into Cascade Pilot for analysis. C. When the first view is applied to the file. D. When "Add Trend Index" is selected from a right-click menu within Cascade Pilot. E. When the file is copied onto a Cascade Shark appliance.


QUESTION NO: 67

If there is a Layer 7 fingerprint and a Layer 4 mapping for a particular application, which of thefollowing is truE. (Select 5)



A. If the Layer 4 mapping override policy is not "Unknown/Unclassified", the Layer 4 mappingapplies to flows not passing a Sensor or other application fingerprinting device as well as to flowsnot matching any defined Layer 7 fingerprint B. If the Layer 4 mapping override policy is "Always", then the Layer 7 fingerprint will never beused for flows matching both criteria C. If the Layer 4 mapping override policy is "Unclassified", the Layer 4 mapping only applies toflows not passing a Sensor or other application fingerprinting device D. If the Layer 4 mapping override policy is "Unknown/Unclassified", the Layer 4 mapping appliesto flows not passing a Sensor or other application fingerprinting device as well as to flows notmatching any defined Layer 7 fingerprint E. Care must be taken when defining reports and policies to reflect overlapping definitions and theLayer 4 override policy F. The traffic Expression "app L7_fingerprint or app L4_mapping" will catch all traffic flows for theapplication data in a report

Answer: B,C,D,E,FExplanation:

QUESTION NO: 68

Technologies used for switching traffic between Virtual Machines under ESXi include:

A. Traffic between Virtual machines is not switched; it is routed by the standard vRouter includedwith ESXi B. A standard or distributed vSwitch which comes with ESXi must be used, there is not 3rd partysoftware available C. A 3rd party virtual switch is required such as the CISCO Nexus 1000v as no standard vSwitchexists with ESXi D. The included standard vSwitch of the CISCO Nexus 7000 E. The included standard vSwitch or the CISCO Nexus 1000v


QUESTION NO: 69

Simple Network Management Protocol can be used on Cascade Profiler for:

A. Accessing the Cascade Profiler's MIB by third-party applications for monitoring. B. Obtaining interface information from routers. C. Obtaining host MAC address information from switches.



D. Obtaining network device status through the Cascade Profiler receiving SNMP traps. E. A, B, and D.


QUESTION NO: 70

The Cascade Profiler authenticates users before logging them in. What are the possible choicesfor authentication? (Select 3)

A. Cascade Profiler local database B. User account specifies authentication by RADIUS C. TACACS D. RADIUS server to authenticate the user

Answer: A,B,DExplanation:

QUESTION NO: 71

What are the sources of Layer7 Fingerprints as shown in the Cascade Profiler GUI? (Select 4)

A. from the Cascade Sensor B. NetFlow C. NBAR D. Packeteer E. User Defined F. Enhanced sFlow

Answer: A,C,D,EExplanation:

QUESTION NO: 72

A SPAN port or Port Mirror differs from RSPAN technology in which way:

A. A SPAN port captures traffic locally, an RSPAN captures traffic remotely



B. A SPAN port captures traffic consistently, an RSPAN captures traffic randomly C. A SPAN port captures multiple ports while an RSPAN is "relational" and captures multipleVLANs (Relational LANs) D. They are both the same with different terms being used by different vendors E. A SPAN port is used on a Switch while a RSPAN is used on a Router


QUESTION NO: 73

Cascade Performance analytic event detail reports include multiple tables that are ordered by:

A. The client or server that has changed the most (for the table metric) from the baseline (forexample, impact). B. The top talker (client) that has sent the most data. C. The top talker (server) that has sent the most data. D. Server Delay so that you can determine if it was a server problem. E. Links that are 95% utilized.


QUESTION NO: 74

If you have a Steelhead at a branch office, and if there is only one device you are allowed tocollect flow data from, which device would be the best choice, if visibility of data before and afteroptimization and reporting on data reduction is important?

A. Steelhead B. CE router C. PE router D. Netflow-enable hosts


QUESTION NO: 75



How many SNMP recipients can receive a single event notification for Cascade Profiler?

A. 1 B. 2 C. 3 D. 4 E. 5


QUESTION NO: 76

What is the minimum number of physical appliances required when building Cascade solution thatwill collect and process 3.6 million unique (de-duplicated) flows/minute from NetFlow sources?

A. 11 for the Cascade Profiler, 3 Cascade Gateways B. 10 for the Cascade Profiler, 3 Cascade Gateways C. 11 for the Cascade Profiler, 5 Cascade Gateways D. 10 for the Cascade Profiler, 5 Cascade Gateways E. 12 for the Cascade Profiler, 4 Cascade Gateways


QUESTION NO: 77

The default group type for all Security Policies is:

A. Application_Servers B. ByFunction C. ByLocation D. Automatic


QUESTION NO: 78



What do you need to configure on the Profiler to detect utilization for an interface?

A. You have to manually configure the interface speeds on the Devices/Interfaces page. B. You have to configure SNMP access to the reporting devices on the Devices/Interfaces page. C. One of either A or B above. D. None of the above; Cascade will figure this out automatically.


QUESTION NO: 79

Is there a way to look at who owns the Domain for an external IP Address shown in the CascadeProfiler GUI?

A. No. B. Yes, you can do this with the "ARIN" lookup in "external links". The customer can also addadditional external links if they have other sites they use to look up IP Addresses. C. This is available as a column in any report that displays the IP Address. D. This is available under IP Host Group Type.


QUESTION NO: 80

In order to create an interactive view on Cascade Pilot:

A. Select two views from the views panel using control-click then right click on one and select"Create Interactive View" from the drop-down menu. B. After a Drill-Down from one view to another, right click on the Drill-Down view in the sourcespanel and select "Create Interactive View" from the drop-down menu. C. Select any item (such as a host IP Address, Port or Protocol name) in the main workspace andright click on the item, then select "Create Interactive View" from the drop-down menu. D. Select any view in the views panel, right-click it and select "Create Interactive View" from thedrop-down menu. E. Open the filters panel, apply an existing or new filter to the view then select "save as interactiveview" from the home menu.

Answer: B



Explanation:

QUESTION NO: 81

On Cascade Profiler, what does "tunneled" indicate when used as a keyword for an Application?

A. When the traffic flow matches more than one Application signature. This indicates that the oneApplication may have been tunneled over the other. B. When an Application runs over a non-standard port (such as TELNET traffic on Port 80). C. When a "port definition" is non-standard (e.g. when you change tcp/80's definition from http totelnet). D. When a Layer-4 Application Mapping is defined.


QUESTION NO: 82

Assume five different devices reported the same flow/conversation to the Cascade Profiler twoRiverbed Steelheads, two routers, and a Cascade Sensor in the data center. For a query thatlooks only for all traffic between the client and server (i.e., no devices or interfaces were specifiedon the query), what bandwidth and packet values will be reported?

A. The smallest bandwidth and packet count recorded by the five devices. B. The largest bandwidth and packet counts recorded by one of the interfaces on one of the fivedevices. C. The mean bandwidth and packet count recorded by the five devices. D. The highest LAN packet count recorded by either Steelhead. E. None of the above the flow records store only the first byte and packet count reported by anyof the reporting devices.


QUESTION NO: 83

Trace clips that no longer have data because their packet data and trend data is no longeravailable in the parent capture job trace:



A. Appear with a red lightning bolt icon within Cascade Pilot. B. Appear with a lock icon within Cascade Pilot. C. Appear with a grey lightning bolt icon within Cascade Pilot. D. Appear with a yellow lightning bolt icon within Cascade Pilot. E. Appear with the trace clip name in red text within Cascade Pilot.


QUESTION NO: 84

Which of the following metrics can Cascade Profiler create dependency (Connection Graphs) for?(Select 3)

A. Average drops B. Average retransmits C. Average response time D. Average utilization E. Total bandwidth bits

Answer: B,C,EExplanation:

QUESTION NO: 85

How many items can be displayed in a single watched list in a Profiler Dashboard Content Block?

A. Unlimited B. Ten C. Four D. Twenty


QUESTION NO: 86

Within Cascade Pilot a Watch can: (Select 3)



A. Send an email when the traffic reaches at least 1MB/sec. B. Notify all Cascade Pilot users connected to a specific Cascade Shark appliance when aspecified traffic event occurs. C. Create a Web traffic report with a specific time window. D. Start a Capture Job each time the VoIP traffic goes below 2MB/sec.


QUESTION NO: 87

On the Cascade Shark appliance, packet de-duplication should be enabled when:

A. Capturing packets from a SPAN-Port/Port-Mirror whose configuration may generate duplicatepackets B. Capturing packets from an aggregating TAP C. Removing duplicate flows across multiple interfaces D. Capturing packets from a 10GB link


QUESTION NO: 88

How do all the Cascade components stay time synchronized?

A. They all point to the same NTP server. B. The Profiler, ideally, points to an NTP server (although it can use local time as well), theGateway and Sensor get their time information from the Profiler which acts as their NTP Server. C. For security reasons, all components use local time. The same time should be set on eachcomponent. D. They all synchronize their time via timestamps in Netflow sources.


QUESTION NO: 89

To better analyze live traffic on Cascade Shark from Cascade Pilot you should:



A. Apply a View on the live interface and then start a Capture Job on the capture port to analyzetraffic later. B. Start a Capture Job on the capture port with a BPF filter and apply a View on the live interfacefor the same capture job. C. Start a Capture Job on the capture port, apply a View on the live interface and create a traceclip for the time window of interest. D. Never create a Capture Job to prevent packet drops.


QUESTION NO: 90

Which TCP port is used for Cascade Profiler web based management interfaces?

A. 80/tcp B. 8080/tcp C. 8090/tcp D. 443/tcp E. 22/tcp


QUESTION NO: 91

Voice over IP (VoIP) monitoring by Network Performance Management systems typically includes,but is not limited to, the following metrics (select 3):

A. MOS scores voice quality issues B. ABC-threshold C. Signal-to-noise ratio D. Jitter E. Packet Loss

Answer: A,D,EExplanation:



QUESTION NO: 92

Which of the following are valid syntax for host group definitions on Cascade Profiler? (Select 2)

A. 192.168.66.* Web Servers B. 192.168.0.100/255.255.0.255 Database_Servers C. 192.168.14.0/24 Mail_Servers D. 192.168.*.* Boston

Answer: B,CExplanation:

QUESTION NO: 93

On an Enterprise Profiler, which Cascade software module usually runs on hardware with anothersoftware module, but can be placed on its own hardware to support extremely large clusters?

A. Event Manager B. Dispatcher C. User Interface D. Database


QUESTION NO: 94

Which parameters can be used to set up an Application Performance analytic on CascadeProfiler?

A. Applications, Ports/Protocols, QOS, Servers, Clients B. Ports/Protocols, QOS, Servers, Clients C. Applications, Ports/Protocols, D. Applications, Ports/Protocols, QOS, Servers, Clients, Interfaces




QUESTION NO: 95

On the Cascade Profiler, which of the following is not a Scanner Choice under Vulnerability ScanSetup? (Select 2)

A. Nessus B. Rapid7 C. Qualys D. Retina E. nCircle F. MBSA

Answer: D,EExplanation:

QUESTION NO: 96

Dynamic Host Configuration Protocol can be used by Cascade Profiler to:

A. Allow user defined policies the ability to dynamically re-configure host IP parameters when thehost triggers an event. B. Obtain an IP address on the Management interface on initial power-up. C. Obtain an IP address on the Auxiliary interface on initial power-up. D. Obtain host MAC address. E. A, B, C.


QUESTION NO: 97

Cascade dependency mapping (Connection Graphs) have multiple 'layouts' for showingdependencies. Which of the following is not an option?

A. Symmetric B. Radial tree C. Vertical client/server dependency D. Starburst E. Horizontal tree

Answer: D



Explanation:

QUESTION NO: 98

When defining a service which of the following are supported ways of aggregating the results?(Select 2)

A. Client Ports B. Applications C. Ports D. Server


QUESTION NO: 99

On the Cascade Profiler, when importing a switch mitigation device list, it needs to be in thefollowing format:

A. host_name, device_type, read_only_community_string, write_community_string B. host_name, IP_address, read_only_community_string, write_community_string C. host_name, IP_address, device_type, read_only_community_string, write_community_string D. host_name, IP_address, device_type, read_only_community_string, write_community_string,pass phrase


QUESTION NO: 100

Filtering in Cascade Pilot: (Select 2)

A. Is either a BPF or Wireshark Display filter only. B. Can be created from a chart. C. Can be changed after applying a View. D. Is the equivalent of the Wireshark "display filter input".




Topic 2, Volume B

QUESTION NO: 101

How many Group Types Can you create on your Cascade Profiler?

A. 5 B. 20 C. 15 D. 10 E. Unlimited


QUESTION NO: 102

One advantage of using a trace clip for analysis within Cascade Pilot instead of its parent capturejob trace is:

A. The trace clip is likely smaller in size, so views load faster. B. The trace clip is moved to the local system, so views load faster. C. The trace clip has a base set of views pre-applied, so analysis is faster. D. The trace clip is guaranteed to have trend/index data, so views load faster.


QUESTION NO: 103

For Service policies that get applied to End User segments, by default separate policies aretracked by location for the client traffic. Which of the following is NOT true regarding flexibility inconfiguration of these End User segments?

A. The default hostgroup type used can be changed from Configuration > General Settings. B. Different hostgroup types can be used for monitoring End User segments for each Service.



C. While editing the Service one has the capability to select all sites or a subset of sites to includefor monitoring. D. When adding a Service Health by Location widget to a dashboard, one has the capability toinclude all locations or a subset (maximum of 10). E. The default hostgroup type used for monitoring End User segments is ByLocation.


QUESTION NO: 104

Which configuration option is it highly recommended that every Cascade Profiler Deploymentimplement?

A. Host Baseline Profiles B. Custom Port Definitions C. Host Groupings D. Mitigation Configuration E. Firewall Configuration


QUESTION NO: 105

In the Cascade Profiler Dashboard GUI, which formats are available for Watched item contentblocks? (Select 5)

A. Line Graphs B. Stacked Area Graphs C. Pie Charts D. Bar charts E. Connection Graphs F. Tables

Answer: A,B,C,D,FExplanation:



QUESTION NO: 106

Can the same IP Address exist in Multiple Host Groups on Cascade Profiler?

A. No, you cannot do this. B. Yes, either within the same Group Type, or across Group Types. C. Yes, but only if the Host Groups are in different Group Types. D. Yes, but only in the ByFunction Group Type. E. Yes, but only in the ByLocation Group Type.


QUESTION NO: 107

Which Cascade device actually polls for the SNMP information in the switch port Discoveryprocess?

A. Application Sensor B. Gateway C. Profiler D. All of the above E. None of the above


QUESTION NO: 108

How does Cascade Profiler track URL's?

A. Each URL that is seen by the Sensor is shown on the dashboard or searchable via reporting. B. Customer defined URL's are mapped to an application name which can then be shown on thedashboard, searched via reporting, or used in Analytic definitions. C. URL's are tracked by either a Cascade Sensor or via NetFlow version 5 (or higher) export. D. Cascade does not track URL's.




QUESTION NO: 109

Additional data sources that Cascade Profiler can leverage besides flow data arE. (Select 3)

A. Active Directory information for successful/failed login association to IPs B. DHCP for host IP to MAC address association. C. SNMP polling to routers, switches, and servers for CPU information. D. SNMP trap data from routers, switches, and servers for security events. E. SNMP polling to routers and switches for MAC address and physical switch port association.

Answer: A,B,EExplanation:

QUESTION NO: 110

To assure the packet data in a trace clip is preserved from Cascade Pilot, you should:

A. Lock the trace clip. B. Send the trace clip packets to file. C. Detach the trace clip from the capture job trace. D. A and B E. A, B, and C.


QUESTION NO: 111

On Cascade Profiler, what is the purpose of a Service Segment when creating a new service?

A. A service segment is the update time period when devices send Netflow to Cascade Gateways. B. A service segment is defined by its components and the applications and/or ports in usebetween them. C. A service segment is defined as the front-end tier that directly services end users with anapplication. D. A service segment is the update time period when Cascade Sensors send MNMP Flow toCascade Profilers.




QUESTION NO: 112

What data do I need from netflow sources for the Cascade Profiler report-by "network segments"to work correctly?

A. Netflow V5 or V9 with TTL export configured. B. NetflowV9 with TTL export configured. C. Any version of Netflow since they all export in/out interface information. D. UDP port.


QUESTION NO: 113

What information is required to configure the Switch Port Discovery feature in the CascadeProfiler? (Select 2)

A. Periodically imported DHCP lease records B. IP address of the outermost switches C. IP address of the lookup router D. IP address of mitigation router


QUESTION NO: 114

A router that has been recently configured to send NetFlow to a Cascade Gateway has yet toappear in the Devices/Interfaces page on the Cascade Profiler. What are the most likely thing tocheck?

A. Traffic is being sent across the router's interfaces configured for flow export. B. There are no firewalls blocking communication between router and Cascade Gateway. C. There are no firewalls blocking communication between Cascade Gateway and Cascade



Profiler. D. The port being used for export on the router matches that which has been configured on theCascade Gateway. E. All of the above.


QUESTION NO: 115

Before running your first report on Cascade Profiler after installation, where is the best place to goto verify traffic flows are currently being received?

A. System Information > Devices/Interfaces B. System Information > Profiler C. Dashboard D. Log in to the shell and view the /usr/mazu/var/log/Sensor.log E. Ping devices on UDP port 2055 to see if they are up and running


QUESTION NO: 116

Which of the following describes how a Cascade Gateway transfers flow data to a CascadeProfiler? (Select 2)

A. It uses IETF's IPFIX protocol. B. Is uses whichever flow protocol it received the data on. C. It uses a proprietary compressed and encrypted connection. D. It sends data over SYSLOG port 514 which is compressed and encrypted via proprietarytechnology. E. It sends data over TCP/41017.


QUESTION NO: 117



What is the maximum number of custom applications that can be defined on a Cascade Profiler?

A. Yes, 25 B. Yes, 50 C. Yes, 100 D. Yes 500 E. No Limit


QUESTION NO: 118

Which of the following flow formats provide QoS information to Cascade?

A. NetFlow v5/7/9 B. Cascade Sensor flow data C. Sflow D. Packeteer Federated Data Records E. All of the above


QUESTION NO: 119

When you create an index within Cascade Pilot for a trace filE. (Select 2)

A. The index will be removed when Cascade Pilot is closed. B. The operation can take a few minutes. C. You cannot apply Views that do not support indexing. D. The trace file icon changes to a lightning bolt to indicate that it is indexed.

Answer: B,DExplanation:

QUESTION NO: 120



What defines a "Recipient" for Cascade Profiler Notifications?

A. An Email Address only B. An SNMP receiver only C. An SNMP receiver only tied to a set of Host Groups D. An Email Address and/or one or two SNMP receivers optionally tied to a set of Host Groups E. An Email Address and/or one or two SNMP receivers optionally tied to a set of User Accounts F. A User Account


QUESTION NO: 121

How is QoS data obtained in a Cascade Profiler? (Select 2)

A. From packets via the Cascade Sensor or Shark B. From NetFlow and other standard flow protocols C. From IP SLAs on any network-attached device D. From CDP E. From NBAR

Answer: A,BExplanation:

QUESTION NO: 122

When using a Network Performance Management tool such as Cascade, TCP sessions can beobserved as completed by observing:

A. TCP Window size is observed as zero B. Buffering bits (zeros) are included in the last packet of the flow C. TCP is connectionless so there is no way to determine completion D. A RST or FIN flag is included in the flow E. A SYN or CPT flag is included in the flow




QUESTION NO: 123

Which of the following data is required for Cascade Profiler to correctly calculate Round-Trip-Time(RTT) between a branch and the datacenter for Steelhead optimized traffic? (Select 2)

A. NetFlow from router on WAN side of branch Steelhead B. NetFlow from router on LAN side of branch Steelhead C. CascadeFlow from branch Steelhead D. CascadeFlow from Data center Steelhead E. Sensor at Data center F. Sensor-VE sending Cascade flow data


QUESTION NO: 124

Within Cascade Pilot, Sequence Diagrams represent TCP Errors in which of the following ways:(Select 2)

A. By listing lost packets in the expert window B. By using dotted-dashed lines for out-of-sequence segments C. By placing error names on the messages within the diagram D. By color-coding the messages on the diagram E. By using a thicker line for messages that include errors


QUESTION NO: 125

When the Discovery wizard presents all newly discovered application-ports as candidates to beincluded as segments for monitoring within a Service, which of the following actions will save thesegment as part of the Service, but will not implement monitoring of the traffic? This action willalso suppress the same application-ports from being presented in any future discovery.

A. Merge B. Add C. Drop D. Delete E. Discover




QUESTION NO: 126

You can analyze data on Cascade Pilot received from live interfaces iF. (Select 2)

A. Cascade Pilot is started with administrator privileges. B. Cascade Shark is configured to show capture ports. C. You apply a View to the interface and create a Watch on Web traffic. D. You have privileges to do so in your user profile.


QUESTION NO: 127

Which configuration screen or screens are edited on the Cascade Shark to change names usedby certain ports within various views on Cascade Pilot:

A. Cascade Pilot Views Advanced Settings under the Settings menu B. Port/Protocols Names and Port/Protocols Groups under the Port/Protocol Definition menu C. Layer-4 Mappings and Application-Definitions under the Definitions menu D. Layer-4 Mappings under the Advanced Settings menu E. Defined as a BPF filter when configuring a Capture job


QUESTION NO: 128

How does Cascade Profiler track Resets?

A. TCP Resets are tracked via reading the TCP header on the Sensor. B. TCP Resets are tracked by collecting the flag via NetFlow. C. Both A and B. D. Cascade does not track Resets.




QUESTION NO: 129

A strip chart within Cascade Pilot shows data points:

A. According to the Cascade Pilot time zone. B. According to the time zone of the Cascade Shark to which you are connected. C. According to Cascade Pilot time zone or optionally, to the Cascade Shark time zone as well. D. According to UTC.


QUESTION NO: 130

In order for the Cascade solution to track an application based on its fingerprint, data can be usedfrom which devices? (Select 3)

A. Packeteer Device B. Cascade Gateway C. Cascade Sensor D. Cisco NBAR device


QUESTION NO: 131

Which of the following are default user-defined policies on Cascade Profiler? (Select 3)

A. P2P application Activity B. SpamBot Activity C. Email traffic surge D. Port Scan E. P2P Port Activity




QUESTION NO: 132

Cascade security baselines model all host-to-host interactions. A host is identified by:

A. AD user name if available, falling back to MAC address if available, falling back to IP address. B. MAC address if available, falling back to IP address if available, falling back to AD user name. C. AD user name if available, falling back to IP address. D. MAC address if available, falling back to IP address.


QUESTION NO: 133

What integrations are available when an enterprise already owns an SNMP monitoring technology(such as Solarwinds or HPOV)? (Select 2)

A. Cascade Profiler can use switch port discovery to retrieve ARP and CAM tables directly fromthe NMS. B. Most NMS' can be configured to SNMP Poll Cascade Profiler to retrieve conversationinformation. C. Network API (from NMS via URL strings to get Cascade Reports) D. There are no integrations; NMS' are competitors to Cascade Profiler. E. External Links (from Cascade Profiler via URL strings to NMS)


QUESTION NO: 134

When drilling down from a Cascade Profiler traffic report to analyze the underlying packets inCascade Pilot, which of the following is NOT required?

A. The flows that are being viewed in Cascade Profiler must be reported by a Shark appliance. B. The user's workstation requires a licensed copy of Cascade Pilot.



C. The user's workstation requires access to the Cascade Shark appliance on the appropriateTCP Port. D. If there are multiple capture jobs configured on the Cascade Shark appliance, the user mustselect which one to apply the trace clip against. E. All of the above.


QUESTION NO: 135

Which Cascade device is capable of sending flow data to more than one Cascade Profiler? (Select3)

A. A Cascade Standard Profiler B. An Cascade Enterprise Class Profiler (only from the Dispatcher Module) C. A Cascade Shark appliance D. A Cascade Gateway E. A Cascade Express Profiler

Answer: C,D,EExplanation:

QUESTION NO: 136

In the Cascade Profiler GUI, what are two default dashboards that are automatically created foreach user account? (Select 2)

A. WAN Dashboard B. Application Dashboard C. Devices/Interfaces View D. Network Operations Dashboard E. Network Security Dashboard

Answer: D,EExplanation:

QUESTION NO: 137



An interactive view within Cascade Pilot is useful for:

A. Applying a very complex filter statement. B. Creating a non-sequential time index. C. Creating a trace clip file with trend index data. D. Interactively connecting charts from 2 or more views. E. Creating a PDF report of a view that can be interactively updated.


QUESTION NO: 138

On a newly created capture job on Cascade Shark appliance, by default, trending/indexing arE. (Select 2)

A. Enabled B. Disabled C. Set to retain up to 1 week or 10GB of indexing/trending data D. Set to retain up to 1 week or 10GB of packets E. Set to keep the indexing/trending data indefinitely

Answer: A,CExplanation:

QUESTION NO: 139

When designing a Cascade deployment which of the following is important to consider aboutsizing?

A. Cascade is sized based upon the number of sources that will be sending NetFlow to aGateway, and the number of Gateway's sending data to a Profiler. Each Gateway is sized tohandle a certain number of sources, and each Profiler a certain number of Sensors and Gateways. B. Cascade is sized by the packet volume across the environment. Each Sensor and Gatewaycomponent can handle a certain packet rate. C. The primary measures are flow-rate and topology. Flow-rate drives the size of the solution;topology can determine the placement of Sensors. As a secondary sizing method we can use hostcount and rule-of-thumb host/flows ratio to estimate the flow-rate. D. Cascade is sized purely based upon the number of Servers being monitored in theenvironment.




QUESTION NO: 140

The Cascade Profiler account roles arE. (Select 5)

A. Administrator B. Operator C. Monitor D. Dashboard Viewer E. dbadmin F. Event Viewer

Answer: A,B,C,D,FExplanation:

QUESTION NO: 141

What is one item for which the analytics license is required?

A. The Analytics license is required to generate traffic report. B. The Analytics license is required to generate network operation dashboard. C. The Analytics license is required to connect CMDB system. D. The analytics license is required for the analytics defined as part of a service to begin theinitialization process.


QUESTION NO: 142

Watches within Cascade Pilot refer to:

A. Interactive views based upon time control. B. A time control window for creating trace clips. C. A panel displaying current time in the packet capture (pcap) file under analysis. D. A triggering and alerting capability based upon traffic views.



E. A triggering and alerting capability using an optional fault management add-on for monitoringrouters and switches.


QUESTION NO: 143

If a Cascade Profiler customer wants to understand if poor user experience for a particularapplication is due to application inefficiency or not, what report parameters should you look at?

A. RTT B. Server delay C. Response time D. Server delay relative to Network RTT E. Number of active connections


QUESTION NO: 144

The Cascade Profiler and Express define a service as all servers, clients, applications and portsinvolved in the end-to-end delivery of a network service. A service is composed of one or more_______________ that can be monitored, reported and alerted on individually.

A. Data Component B. Segments C. Report Criteria D. Router E. User(s)


QUESTION NO: 145

In Cascade, how are custom Layer 7 applications configured?



A. On the Sensor, you must define either a hex string, text string, or URL. B. On the Profiler, you must define either a hex string, text string, or URL. C. On the Gateway, you must define either a hex string, text string, or URL. D. You have to first enable security analytics on the Profiler, then you define either a string or URLon either the Profiler or the Sensor. E. Custom applications cannot be defined, but the Sensor can identify most off-the-shelfprograms.


QUESTION NO: 146

When using Network Performance Monitoring solutions the following statements are truE. (select2)

A. HTTP Object load times can be analyzed with full packet capture B. SSL Decryption can be used without any special key imports provided the start of the TCPconversation is captured C. Software Agents are required on Servers in order to measure the Network Round trip time ofapplications D. ICMP (ping echo/response) must be used in order to measure Network Round Trip time E. NetFlow records can be summarized to provide utilization on a router interface

Answer: A,EExplanation:

QUESTION NO: 147

Common TCP Errors which may be observed within a network include:

A. Zero Window Size, Retransmits, or FIN Flags observed B. Increasing Window Size, Resets, Retransmits C. Zero Window Size, Retransmits, Lost Packets D. SYN, FIN, or RST flags observed E. RST or FIN flag observed or Retransmits observed




QUESTION NO: 148

Within Cascade Profiler the Event Policy categories for which you can receive alerts includE. (Select 4)

A. Performance and Availability B. TCP Health C. VoIP D. Security E. Health F. User-defined Policy

Answer: A,D,E,FExplanation:

QUESTION NO: 149

If you use overlapping IP address ranges (for example 10.0.0.0/8, 10.1.2/16, and 10.2.3/24) in ahost group definition on Cascade Profiler which of the following is true?:

A. The Profiler assigns a host to all overlapping custom groups. B. The Profiler assigns a host to the custom group whose definitions has the shortest matchingprefix. C. The Profiler assigns a host to the custom group whose definitions has the longest matchingprefix. D. An error message is generated.


QUESTION NO: 150

On Cascade Profiler, Active Directory user names and login information are obtained via theActive Directory Connector from:

A. On demand queries to the AD server(s) B. A10 networks ID Series appliance C. Active Directory audit logs D. RADIUS

Answer: C



Explanation:

QUESTION NO: 151

What methodologies does the Cascade Profiler use to display MAC address information alongwith other host information?

A. Import DHCP lease files or SNMP polling of switches. B. Manually enter MAC address information via the user interface. C. The Cascade Profiler cannot display MAC address information. D. This information is received via sFlow and/or NetFlow. E. MAC address information is stored as part of the information received from Cascade Sensorsand Regional Gateways.


QUESTION NO: 152

Within the Cascade Pilot GUI, the following filter types are availablE. (Select 3)

A. Wireshark display filter B. BPF C. Cascade Pilot Filter D. Cascade-Scripting filter E. IP chains filter


QUESTION NO: 153

What conditions might prevent successful SNMP polling of a flow source? (Select 2)

A. An ACL might exist on the flow source (router) and the Cascade Standard Profiler IP address isnot in it. B. SNMP is not enabled. C. The correct IP address of the flow source was not entered into the GUI.



D. The SNMP read string provided and entered might not be correct. E. The flow source is not using the same NTP source as the Cascade Gateway.

Answer: B,DExplanation:

QUESTION NO: 154

What is the typical retention time of packets of a CSK-01100 Cascade Shark appliance with 1capture job?

A. About 34 hours with a captured length of 65535 bytes and a packet rate of 400kbps B. About 9 hours with a captured length of 1000 bytes and an average traffic rate of 1Gbps. C. About 18 hours with a captured length of 65535 bytes and an average traffic rate of 500Mbps. D. About 20 hours with a captured length of 500 bytes and an average packet rate of 400kbps.


QUESTION NO: 155

Cascade Profiler Dashboard can be configured to show: (Select 3)

A. The top applications for the previous week. B. Only the IPs that a user is authorized to see. C. Bandwidth for a host group over the previous day. D. Bandwidth for interfaces from devices NOT sending flow data. E. Connections for interfaces from devices sending flow data.

Answer: A,C,EExplanation:

QUESTION NO: 156

What best describes the Rebalance and Reallocate buttons on the Configuration/Flow Log page ofthe Cascade Profiler? (Select 2)

A. Rebalance moves flows among analysers in a Cascade Enterprise Profiler.



B. Reallocate varies the storage space dedicated for templates and saved reports. C. Rebalance optimizes the use of the allocated space that allows you to get a longer retentiontime out of the same amount of disk space. D. Reallocate allows the users to decide the percent of total disk storage capacity that is allocatedto the various flow logs. E. Rebalancing and Reallocating must be done simultaneously.


QUESTION NO: 157

In a Cascade deployment with Sensor and Profiler, what information does the ApplicationPerformance Policy report show? (Select 4)

A. Number of connections per second B. Average response time C. TCP resets D. TCP retransmission E. Number of jumbo frames F. CPU and memory utilization of server

Answer: A,B,C,DExplanation:

QUESTION NO: 158

What are three ways Cascade Shark can monitor packet data in an environment: (Select 3)

A. Connect a capture port to a Port mirroring monitor port (also referred to as a SPAN port). B. Connect two capture ports to a passive network tap on a live link. One capture port is used foreach direction of the link. C. Use the built-in AirCard capture port to capture traffic from a wireless network. D. Connect two capture ports across a link connected to a SPAN port already being used forpacket capture to another type of monitoring device and place Cascade Shark in "passthru" mode. E. Send sFlow with sampled packets to a Cascade Shark Capture port which has been placed insFlow collection mode.




QUESTION NO: 159

Which of the following is valid syntax for defining host groups? (Select 3)

A. 192.168.0.100/255.255.0.255 Philadelphia B. 192/8 Baltimore C. 172.168.1.1 Phoenix D. 10/16 Chicago


QUESTION NO: 160

What is the maximum number of Cascade Profilers that can be configured in the Cascade Sharkappliance as receivers of flows?

A. 1 B. 2 C. 3 D. 4 E. Unlimited


QUESTION NO: 161

How is the Cascade Pilot license activated?

A. The license key is entered during installation. The license is activated either through an Internetconnection or by phone. B. The license key is entered during installation. The license must be activated through an Internetconnection. C. The license key is entered during installation. There is no activation but Cascade Pilot willdetect if the license is already in use on the network. D. There is no license key activation. The software image is shipped with the license key installed.




QUESTION NO: 162

To install Cascade Shark, the best practice to initially configure the IP Address to be used on thenetwork is:

A. Connect a cross-over cable from your laptop to the Ethernet management port and connectthrough the Web browser to the default IP Address of 192.168.1.10. B. Connect a cross-over cable from your laptop to the Auxiliary Ethernet port and connect throughthe Web browser to the default IP Address of 192.168.1.10. C. Connect by KVM or Serial Console and run the command line tool, sa_wizard, to perform theinitial configuration. D. Connect to the appliance using the Riverbed Central Management Console (CMC) on itsdefault IP Address and perform the initial configuration.


QUESTION NO: 163

A SPAN port is often limited in which way:

A. Can only capture traffic from a single port. B. Can only capture traffic that is routed (not switched) C. Can only capture traffic that is ingress or received by the device D. The number that can be configured is oftentimes limited to two E. Requires at least two monitoring ports to capture a single link


QUESTION NO: 164

How many signatures can a Layer-7 Fingerprint have?

A. 1



B. 2 C. 5 D. 8 E. 10


QUESTION NO: 165

What is the chart granularity possible through the Cascade Pilot UI? (Select 2)

A. 1 second on a local System, 10 milliseconds on Cascade Sharks. B. 1 millisecond for any View. C. 1 millisecond for specific Views. D. Generally minimum 1 second, maximum 1 day.


QUESTION NO: 166

Which of the following is information that Netflow v5 provides to the Cascade solution? (Select 2)

A. End time of Flow B. Source MAC address C. Layer 4 Protocol Type D. TCP Checksum Validation Result


QUESTION NO: 167

Hosts that do not match group definitions within a group type are:

A. Placed in an unassigned group. B. Not placed into a group within the group type.



C. Not allowed D. Flagged as an error. E. Likely to cause errors in the future.


QUESTION NO: 168

On the Cascade Shark Appliance, which User Groups on the appliance exist by default:

A. Administrators, Operators, Monitors B. Read-Only-Group, Read-Write-Group, Full-Access Group C. Administrators, Network-Operations, Network-Security D. Administrators, NormalUsers, Viewers E. Administrators, Operators, Monitors, Viewers


QUESTION NO: 169

How are trace clips created in Cascade Pilot? (Select 2)

A. Select a Capture Job, right-click, and select "Create Trace Clip". B. Drag a bar from a Bar Chart to the Capture Job. C. Click the + button in the Capture Job item and select a time window. D. Select a time window and apply a Cascade Pilot filter.


QUESTION NO: 170

If Cascade is unable to keep a record of all hops traversed due to exceeding its limits, what is theorder of preference for selecting which hops to preserve?

A. Preserve order as received at Gateway.



B. Preserve order as received at Profiler. C. Sensors, Sensor-VEs, Steelheads, xFlow (NetFlow, sFlow, Jflow, Cflow). D. Steelheads, Sensors, Sensor-VEs, xFlow (NetFlow, sFlow, Jflow, Cflow). E. xFlow (NetFlow, sFlow, Jflow, Cflow), Steelheads, Sensors, Sensor-VEs.


QUESTION NO: 171

On Cascade Profiler, Which of the following behavioral analytic policy types are available inCascadE. (Select 3)

A. Application performance B. Link performance C. Host performance D. Application availability E. Service level performance F. Conformance verification G. Link congestion

Answer: A,D,GExplanation:

QUESTION NO: 172

For a TCP conversation that is non-optimized but being reported by a branch Steelhead appliance,the data center Steelhead appliance, and a data center Cascade Shark appliance, how is theNetwork RTT calculated?"

A. The network setup (time between SYN to 1st ACK) is added together across the threesegments: client to branch Steelhead appliance, branch Steelhead to DC Steelhead appliance, DCSteelhead appliance to the Server. B. The Server Delay time minus the Client Delay time. C. The top talker (server) that has sent the most data. D. The network setup time reported by the Cascade Shark appliance, which is the time betweenthe reported client-->server SYN and the 1st client-->server ACK.




QUESTION NO: 173

Cascade provides a means for contacting other network devices for additional information about ahost or user of interest. Right-clicking a host name, IP address, MAC address or port number andchoosing _________________ from the shortcut menu sends a query to the other network device.

A. View Packets B. Error Report C. Restart Service D. View Switch Port E. External Link


QUESTION NO: 174

What protocol/port does the Gateway use to collect NetFlow?

A. UDP, TCP, or SCTP on any defined port B. UDP only for any port or ports as defined by the operator C. UDP only for a single port as defined by the operator D. UDP and TCP for any port as defined by the operator E. UDP/2055


QUESTION NO: 175

When creating a custom view in Cascade Pilot, customizations may includE. (Select 3)

A. In-chart tool controls B. Data Retention Time C. Chart Color scheme D. Application of a Filter E. Sampling Time



Answer: B,D,EExplanation:

QUESTION NO: 176

What is the Active Timeout requirement on flow sources sending NetFlow to Cascade?

A. Any active timeout can be used; Cascade will calculate the statistics accordingly and updatethe dashboard accordingly. B. 60 Seconds. C. 60 Milliseconds. D. 15 Minutes.


QUESTION NO: 177

Which filter should be used to analyze a capture job within Cascade Pilot?

A. Use a BPF filter to speed up the View. B. Apply a generic View and then define a filter by drilling-down through a more specific View. C. Use a Cascade Pilot filter first and then a BPF filter. D. Create a time filter and then apply a View with a Cascade Pilot filter.


QUESTION NO: 178

What is one way Cascade obtains information about retransmissions in the network?

A. It obtains L2 retransmissions from switches and routers via SNMP. B. It obtains TCP retransmissions by tracking TCP sessions via the Cascade Sensor. C. Cascade does not track retransmissions. D. Cascade obtains retransmissions from NetFlow and/or sFlow marked with the TCP push flag.

Answer: B



Explanation:

QUESTION NO: 179

Which of the following are true about Trend/Index data on a Cascade Shark appliancE. (Select 3)

A. Allows Cascade Pilot to load views that take advantage of the Index more quickly. B. Includes the number of bytes and packets for each conversation seen by the Cascade Sharkappliance. C. It is configured on a per-port basis. D. It is configured using the sa-wizard as part of the initial configuration. E. It is enabled by default per capture job.


QUESTION NO: 180

Which DHCP Server Product(s) are supported with the Cascade DHCP integration?

A. QIP B. ISC C. Infoblox D. Windows DHCP E. All of the above F. None of the above


QUESTION NO: 181

Cascade Profiler is able to report traffic using two different approaches (centricities). Twoapproaches can result in different results when using the same report criteria due to the way datais aggregated and counted. What are these two approaches? (Select 2)

A. Interface centric B. Application centric



C. Host centric D. Port centric E. The Cascade Profiler does not have two approaches


QUESTION NO: 182

How many Cascade Notification Policy Levels are there?

A. 1 B. 2 C. 3 D. 4 E. 5


QUESTION NO: 183

Common methods for receiving alerts from a Network Performance Management system includE. (select 2)

A. Traps sent via NetFlow, sFlow, or IPFX B. Alerts sent via eMail C. Traps sent via SNMP D. Traps sent via SPAN E. Traps sent via FIX Protocol


QUESTION NO: 184

In Cascade Profiler, which of the following is available as a Dashboard content block? (Select 3)



A. Top Hosts B. Top URLs C. Watched Interfaces D. Current Events


QUESTION NO: 185

A capture job definition on Cascade Shark may includE. (select 3)

A. A BPF packet filter B. A disk space allocation C. Time-based display resolution D. Trend/Indexing parameters E. Access credential information


QUESTION NO: 186

Which example, assuming we want the 192.168.1 subnet shown as "Tokyo", shows the correctsyntax for setting up this host group under a host group type on Cascade Profiler?

A. "192.168.1.0/24 Tokyo" B. "Tokyo = 192.168.1.0/24" C. "192.168.1.0-192.168.1.255 Tokyo" D. "192.168.1.0;255.255.255.0 Tokyo"


QUESTION NO: 187

How does Cascade acquire the Interface Name (ifname) and interface speed (ifspeed) forinterfaces reporting to Cascade?



A. SNMP polling from the Gateway B. SNMP polling from the Profiler C. SYSLOG D. All of the above E. None of the above


QUESTION NO: 188

Where is one place Cascade Profiler can obtain Identity (user) information for use in reporting useractivity on a network?

A. Through Radius Server(s) B. From Domain Controller(s) C. Through LDAP queries D. Via SNMP queries


QUESTION NO: 189

Company X wants to use Cascade for monitoring the performance of their SQL application to allremote sites before considering purchasing any WAN optimization technology. They would like toadd a Cascade Sensor to their network, and therefore they must:

A. Enable SPAN or mirror port on a switch in their datacenter, whic

rcsp cascade 299-01

Documents