CompTIA Network+ Network+ Network Monitoring and Logging 2 — Questions and Answers
Question 1: A network administrator wants to monitor bandwidth utilization on all WAN links in real time. Which protocol is most appropriate for collecting this data from routers?
- SNMP
- Syslog
- NetFlow (Correct answer)
- ICMP
Correct answer: NetFlow
NetFlow collects IP traffic statistics including bandwidth utilization per flow, making it ideal for WAN link monitoring.
Question 2: Which SNMP component is responsible for sending unsolicited alerts to the NMS when a threshold is exceeded?
- MIB
- OID
- Trap (Correct answer)
- Community string
Correct answer: Trap
SNMP Traps are unsolicited notifications sent by an agent to the NMS when a predefined threshold or event occurs.
Question 3: A syslog message has a severity level of 2. How should the administrator classify this message?
- Informational
- Warning
- Critical (Correct answer)
- Emergency
Correct answer: Critical
Syslog severity level 2 is 'Critical,' indicating serious conditions that require immediate attention.
Question 4: What is the primary advantage of using SNMPv3 over SNMPv1 in a production network?
- Faster polling intervals
- Support for more MIB objects
- Authentication and encryption (Correct answer)
- Larger community string length
Correct answer: Authentication and encryption
SNMPv3 adds user-based authentication and AES/DES encryption, addressing the security weaknesses of SNMPv1/v2c.
Question 5: An administrator notices that log timestamps across multiple network devices do not match. Which service should be implemented to resolve this?
- DNS
- NTP (Correct answer)
- DHCP
- RADIUS
Correct answer: NTP
NTP (Network Time Protocol) synchronizes clocks across all network devices, ensuring consistent log timestamps.
Question 6: Which tool would a network engineer use to capture and analyze raw packets traversing a network segment for troubleshooting?
- SNMP manager
- Protocol analyzer (packet sniffer) (Correct answer)
- Syslog server
- NetFlow collector
Correct answer: Protocol analyzer (packet sniffer)
A protocol analyzer (such as Wireshark) captures raw packets for deep inspection of network traffic.
Question 7: A company wants to detect port scans and brute-force login attempts on its network. Which system should be deployed?
- Syslog server
- SNMP trap receiver
- IDS/IPS (Correct answer)
- NetFlow analyzer
Correct answer: IDS/IPS
An Intrusion Detection/Prevention System (IDS/IPS) identifies and can block malicious activities like port scans and brute-force attacks.
CompTIA Network+ Network+ Network Monitoring and Logging 2
A network administrator wants to monitor bandwidth utilization on all WAN links in real time.
Which protocol is most appropriate for collecting this data from routers?