Network+ Network Monitoring and Logging Flashcards

A network administrator configures SNMPv3 with 'authPriv' security level. What does this provide?

Answer: Both authentication and encryption

The SNMPv3 'authPriv' security level provides both message authentication (using MD5 or SHA) and encryption (using DES or AES).

Which type of monitoring examines traffic without being inline with the network flow, using a SPAN port or network tap?

Answer: Passive monitoring

Passive monitoring captures a copy of traffic via SPAN ports or taps without intercepting the actual flow.

What is the primary function of a network management system (NMS) in relation to SNMP?

Answer: Poll managed devices and collect SNMP data for analysis

An NMS acts as the SNMP manager, polling agents on managed devices to collect performance and status data for analysis.

A log shows the entry: 'Jul 4 03:15:22 router01 %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to down.' What syslog severity level does '5' represent?

Answer: Notice

Syslog severity level 5 is 'Notice,' indicating a significant but non-error condition that may require attention.

Which metric should a network administrator monitor to detect potential memory exhaustion on a core switch?

Answer: Available memory (free RAM)

Monitoring available free RAM alerts administrators before memory exhaustion causes packet drops or device instability.

An organization needs logs retained for compliance purposes for three years. Which feature of a SIEM system addresses this requirement?

Answer: Long-term log archiving and retention

SIEM platforms include log archiving and configurable retention policies to meet regulatory and compliance requirements.

What does a high number of CRC errors on a network interface typically indicate?

Answer: Physical layer issues such as a faulty cable or NIC

CRC (Cyclic Redundancy Check) errors indicate corrupted frames, typically caused by faulty cables, connectors, or network interface cards.