6.6

Question 1

You are the administrator of a large network for EastSim, Co. In the Washington DC location, users are
complaining that one server’s performance is exceptionally slow.
You have checked the error logs and have found no cause for concern although resource utilization is much
higher than the baseline. You suspect there may be some kind of Denial of Service attack against the
computer. You would like to be able to monitor inbound and outbound traffic on that computer and perhaps
capture several frames to analyze the contents.
What should you do?

From the affected machine, run System Monitor.

From the affected machine, check the Security Log in Event Viewer.

From the affected machine, run Network Monitor.

From the affected machine, check the System Log in Event Viewer.

Answer 1

From the affected machine, run Network Monitor.

Question 2

You manage a small business network with a single subnet. All devices are connected through a series of
three switches.
You want to monitor traffic between Srvl and Srv2. You install Network Monitor on Srv3 and start a capture
to capture all packets.
After you stop the capture, you cannot see any packets sent between Srvl and Srv2.
What should you do?

Remove any display filters.

Enable p-mode in Network Monitor, then restart the capture.

Remove any capture filters, then restart the capture.

Enable the network interface card for capturing in Network Monitor, then restart the capture.

Run Network Monitor on Srv2.

Answer 2

Run Network Monitor on Srv2.

Question 3

Srv1 is running a custom application that uses a custom packet type. You want to monitor network traffic to
and from Srvl for this application.
You run Network Monitor on Srvl. You want to create a filter that captures only packets used by this
application. When you go to create the filter, you cannot see the packet type listed.
What should you do?

Create a conversation for the application.

Remove any display filters currently configured.

Enable p-mode in Network Monitor.

Obtain the parser file for the application and add it to Network Monitor.

Answer 3

Obtain the parser file for the application and add it to Network Monitor.

Question 4

You are using Network Monitor to monitor network traffic coming into and out of a Windows Server 2012
system.
You want to group the frames captured based on their attributes. Click the capture option you should enable
to accomplish this.

Answer 4

Enable Conversations

Question 5

You manage a Windows Server 2012 system that functions as Hyper-V hypervisor, hosting several Windows
Server 2012 virtual machines.
One of these virtual machines has been experiencing poor performance due to excessive network utilization.
You want to use Network Monitor to capture and analyze network traffic addressed to this virtual machine.
You’ve accessed the virtual machine’s settings and navigated to the advanced configuration screen for its
network adapter, as shown in the figure below.
Click the configuration option that you would enable to monitor network traffic with a packet sniffer such as
Network Monitor.

Answer 5

Mirroring Mode: “none”