CompTIA Network+ Network+ Network Monitoring and Logging 3 — Questions and Answers
Question 1: Which NetFlow version introduced support for IPv6 and flexible flow record definitions?
- NetFlow v1
- NetFlow v5
- NetFlow v9 (Correct answer)
- NetFlow v3
Correct answer: NetFlow v9
NetFlow v9 introduced a template-based format that supports IPv6, MPLS, and flexible record definitions.
Question 2: A network administrator needs to review logs from firewalls, switches, and servers in a single interface. Which solution best meets this requirement?
- Dedicated syslog server
- SNMP NMS
- SIEM platform (Correct answer)
- Packet analyzer
Correct answer: SIEM platform
A SIEM (Security Information and Event Management) aggregates and correlates logs from multiple sources into a unified interface.
Question 3: What does the term 'baseline' refer to in the context of network monitoring?
- The lowest measured traffic value
- Normal network performance metrics used for comparison (Correct answer)
- The default SNMP community string
- The minimum acceptable bandwidth for SLAs
Correct answer: Normal network performance metrics used for comparison
A baseline captures normal network performance metrics so that deviations indicating problems or attacks can be identified.
Question 4: Which syslog facility code is typically used for messages generated by the kernel?
- 0 (Correct answer)
- 3
- 16
- 23
Correct answer: 0
Syslog facility code 0 is reserved for kernel messages, the lowest-level source of system events.
Question 5: An administrator configures SNMP with a read-only community string of 'public.' What security risk does this create?
- Devices cannot send traps
- Attackers can read device configuration data (Correct answer)
- SNMP polling will fail
- MIB objects become inaccessible
Correct answer: Attackers can read device configuration data
'Public' is the well-known default SNMP community string, allowing any attacker aware of it to query device information.
Question 6: Which monitoring approach uses software agents installed on hosts to collect detailed performance data and send it to a central server?
- Agentless monitoring
- Agent-based monitoring (Correct answer)
- Passive monitoring
- Out-of-band monitoring
Correct answer: Agent-based monitoring
Agent-based monitoring installs software on each host to collect granular local metrics and forward them to a central management system.
Question 7: A technician notices that CPU utilization on a core router spikes to 95% every day at 2:00 AM. What is the most likely cause?
- DDoS attack
- Scheduled backup or routing table update (Correct answer)
- Syslog server misconfiguration
- SNMP trap storm
Correct answer: Scheduled backup or routing table update
Scheduled tasks like backups, software updates, or routing protocol reconvergence commonly cause predictable CPU spikes at specific times.
CompTIA Network+ Network+ Network Monitoring and Logging 3
Which NetFlow version introduced support for IPv6 and flexible flow record definitions?