CompTIA Network+ Network+ Network Monitoring and Logging 3

Question 1

Which NetFlow version introduced support for IPv6 and flexible flow record definitions?

Accepted Answer

NetFlow v9

Answer

NetFlow v9 introduced a template-based format that supports IPv6, MPLS, and flexible record definitions.

Question 2

A network administrator needs to review logs from firewalls, switches, and servers in a single interface. Which solution best meets this requirement?

Accepted Answer

SIEM platform

Answer

A SIEM (Security Information and Event Management) aggregates and correlates logs from multiple sources into a unified interface.

Question 3

What does the term 'baseline' refer to in the context of network monitoring?

Accepted Answer

Normal network performance metrics used for comparison

Answer

A baseline captures normal network performance metrics so that deviations indicating problems or attacks can be identified.

Question 4

Which syslog facility code is typically used for messages generated by the kernel?

Accepted Answer

0

Answer

Syslog facility code 0 is reserved for kernel messages, the lowest-level source of system events.

Question 5

An administrator configures SNMP with a read-only community string of 'public.' What security risk does this create?

Accepted Answer

Attackers can read device configuration data

Answer

'Public' is the well-known default SNMP community string, allowing any attacker aware of it to query device information.

CompTIA Practice Test