Network+ Network Monitoring and Logging Flashcards

Which NetFlow version introduced support for IPv6 and flexible flow record definitions?

Answer: NetFlow v9

NetFlow v9 introduced a template-based format that supports IPv6, MPLS, and flexible record definitions.

A network administrator needs to review logs from firewalls, switches, and servers in a single interface. Which solution best meets this requirement?

Answer: SIEM platform

A SIEM (Security Information and Event Management) aggregates and correlates logs from multiple sources into a unified interface.

What does the term 'baseline' refer to in the context of network monitoring?

Answer: Normal network performance metrics used for comparison

A baseline captures normal network performance metrics so that deviations indicating problems or attacks can be identified.

Which syslog facility code is typically used for messages generated by the kernel?

Answer: 0

Syslog facility code 0 is reserved for kernel messages, the lowest-level source of system events.

An administrator configures SNMP with a read-only community string of 'public.' What security risk does this create?

Answer: Attackers can read device configuration data

'Public' is the well-known default SNMP community string, allowing any attacker aware of it to query device information.

Which monitoring approach uses software agents installed on hosts to collect detailed performance data and send it to a central server?

Answer: Agent-based monitoring

Agent-based monitoring installs software on each host to collect granular local metrics and forward them to a central management system.

A technician notices that CPU utilization on a core router spikes to 95% every day at 2:00 AM. What is the most likely cause?

Answer: Scheduled backup or routing table update

Scheduled tasks like backups, software updates, or routing protocol reconvergence commonly cause predictable CPU spikes at specific times.