Chap 3 - Network Operations Flashcards
MIB
Management Information Base
- database that stores all reosurces to be monitored
- data is hierarcical
- resources are atrrtibuted an ID, OID, object identifier
SNMP
Simple Network Management Protocol
- SNMPv1 (1988): Initial version, basic features for network management. Cleartext string authenication
- SNMPv2: added better security, but not backwards compatible with v1
- SNMPv2c: Minor tweaks to SNMPv1, improving efficiency, uses community strings for authenitcation, which are cleartext for backwards compatibility with v1
- SNMPv3: Adds encryption, robust authentication, and enhanced device management features.
- Communication: Uses UDP ports 161 (agent) and 162 (NMS aka traps)
3-1: After starting work as the network admin of Wingtip toys, you discovery that all of the switches in the company’s datacenter have support for remote management with built-in SNMP agents in each port. Which of the following tasks must you perform to be able to gather informaiton from the agents on those switches and display it on the central console? (Choose all that apply)
- Install the network management software on a network computer
- Install a MIB on each of the switches
- Install an agent on the console computer
- Install an MIB on the console computer
- Purchase a network management product
- Install the network management software on a network computer
- Purchase a network management product
Three items in an SNMP based network management system
- a management console software product installed on a network computer
- agents installed on the devices you want to manage
- MIBs for each of the agents
Note: if a switch already has built-in support for SNMP, it means that they already have the agents and MIBs installed
3-2: Which version of SNMP do not include any security protection other than a cleartext community string? (Choose all that apply)
SNMPv1
SNMPv2
SNMPv2c
SNMPv3
SNMPv1
SNMPv2c
3-3: Which of the following statements about SNMP are not true? (Choose all that apply)
- To effectively monitor a network using SNMP, you must be sure that all of the equipment you purchase when designing and building your network supports the protocol
- SNMP is not only the name of a protocol, its also the name of a network management product
- SNMPv1 and SNMPv2 rely on a community string as their only means of security
- Most of the network management products on the market today support SNMPv1
- SNMP is not only the name of a protocol, its also the name of a network management product
- SNMPv1 and SNMPv2 rely on a community string as their only means of security
Syslog
- Syslog Server: Collects messages from multiple devices across a network.
- Listening Port: Uses UDP port 514 for logging messages from clients.
- Log Reviews: Supports analysis of traffic logs and audit logs.
- Message Tagging: Can automatically categorize messages by severity levels, ranging from 0 (Emergency) to 7 (Debug).
- Telcos: Use TCP port 601 for syslog, though this is less common in general IT contexts
3-6: You are the network admin of your company’s network. Your company wants to peform a baseline anaylsis of network related traffic and statisitics. They want to track broadcasts, Cyclical Redundancy Check (CRC) and collision for all traffic transversing a switched network. In addition, they want to provide historical and daily reports for management. They also want to keep track of software distribution and metering. What type of network software product best meets their needs?
SNMP management
Protocol analyzer
Performance monitor
Network traffic monitor
SNMP management
3-8: SIEM products combine the capabilities of which of the following (Choose all that apply)
Syslog
SNMP
SEM
SIM
SEM
SIM
SEM
SEM (Security Event Management)
involves real-time monitoring of security events across the entire enterprise, often through edge devices, and centralizing security and event logs for analysis
SIM
Security Information Management (SIM)
This pertains to the practice of collecting, monitoring, and analyzing security-related data from computer logs and various network sources to identify security threats or incidents.
3-10: Which of the following statements best describes a baseline?
- A baseline is an estimation of expected performance levels, based on manufacturer’s specifications
- A baseline is a record of performance levels captured under actual workload conditions
- A baseline is a record of performance levels captured under simulated workload conditions
- A baseline is a record of performance levels captured before the system is actually in use
A baseline is a record of performance levels captured under actual workload conditions
Syslog codes
- 0 (emergency) -7 (debug)
- code 0 means the system is unusable
- code 1 is an alert message meaning immediate action is needed
- code 2 is a critical condition alert
- code 3 is an error condition
- code 4 is a warning
- code 6 is information
- code 7 is debug (lots of info)
3-18: Which of the following are reasons contributing to the number of packet drops displayed by an interface montior? (Choose all that apply)
Resets
Discards
Errors
Overflows
Discards
Errors
Discards
the process where a router discards a packet when its Time to Live (TTL) number decreases to zero at each hop
Overflows
where a system or a buffer cannot handle more data than it is designed to hold, leading to data loss or system malfunctions
3-20: Log management typically consists of which of the following tasks? (Choose all that apply)
Rollback
Utilization
Security
Cycling
Security
Cycling
Cycling
technique for managing log size by configuring it to delete the oldest record each time a new one is added
3-21: Which of the following SIEM processes performs searches for specific critieria, during specific timeframes, in logs located on different computers?
Data aggregration
Forensic analysis
Correlation
Retention
Forensic analysis
3-22: Which of the following terms best describes the SIEM process of consolidating log information from multiple sources?
Data aggregration
Forensic analysis
Correlation
Retention
Data aggregration
Jitter
connectivity problem on wired networks that is caused by individual packets that are delayed due to network congestion, different routing, or queuing problems
affects VoIP and streaming media mostly
3-23: Which of the following terms best describes a connectivity problem on wired networks that is caused by individual packets that are delayed due to network congestion, different routing, or queuing problems?
Latency
Attenuation
Jitter
Bottleneck
Jitter
3-24: Which of the following network interface occurences are considered to be malfunctions on a full-duplex Ethernet network? (Choose all that apply)
Runts
Giants
Collisions
Late Collisions
Runts
Giants
Collisions
Late Collisions
Runts
packets smaller than the 64-byte minimum allowable length