Free CompTIA Network+ Network Monitoring and Logging Questions and Answers 1 — Questions and Answers
Question 1: A network administrator needs to centralize log messages from various multi-vendor network devices like routers, switches, and firewalls into a single server for analysis. The solution must use a standard, widely supported protocol for sending these event messages across the network. Which protocol is BEST suited for this purpose?
- SNMP
- Syslog (Correct answer)
- NetFlow
- ICMP
Correct answer: Syslog
Syslog is the industry standard protocol specifically designed for forwarding log and event messages from network devices to a central logging server. While SNMP can send 'traps' (notifications), its primary purpose is device management and monitoring of specific variables, not comprehensive logging. NetFlow is for collecting IP traffic metadata, and ICMP is for network diagnostics.
Question 2: In the Simple Network Management Protocol (SNMP) architecture, which component is a hierarchical database residing on a managed device that contains variables and objects the device can report on or be configured for?
- SNMP Agent
- SNMP Trap
- Network Management Station (NMS)
- Management Information Base (MIB) (Correct answer)
Correct answer: Management Information Base (MIB)
The Management Information Base (MIB) is a database of manageable objects on a network device. [14, 25, 26] The SNMP Agent is the software on the device that responds to requests, the NMS is the console that sends requests, and a Trap is an unsolicited alert sent from the agent to the NMS.
Question 3: A security analyst needs to investigate a potential data breach by correlating firewall logs, web server access logs, and authentication logs from a domain controller. The goal is to identify suspicious patterns, such as a brute-force attack followed by unauthorized data access. Which system is specifically designed to aggregate, normalize, and correlate log data from multiple disparate sources for security analysis?
- Security Information and Event Management (SIEM) (Correct answer)
- Intrusion Detection System (IDS)
- Protocol Analyzer
- Network Management System (NMS)
Correct answer: Security Information and Event Management (SIEM)
A Security Information and Event Management (SIEM) system is the correct tool for this task. Its core function is to collect, aggregate, and analyze log data from various security tools and network devices to provide a comprehensive view of an organization's security posture and enable threat detection through event correlation. [2, 3, 4, 5] An IDS is a source of logs, a protocol analyzer captures live traffic, and an NMS focuses on network performance monitoring.
Question 4: A network technician needs to perform a deep inspection of network traffic to diagnose a complex application issue. The technician wants to capture and view the individual headers and payloads of packets being sent to and from a specific server. What type of tool is required for this task?
- Throughput tester
- Log aggregator
- Protocol analyzer (Correct answer)
- Port scanner
Correct answer: Protocol analyzer
A protocol analyzer, also known as a packet sniffer (e.g., Wireshark), is designed to capture, decode, and display the contents of network packets, including their headers and payloads. [7, 8, 9] This allows for in-depth analysis of network communications. A throughput tester measures bandwidth, a log aggregator collects Syslog data, and a port scanner checks for open ports.
Question 5: A network manager has noticed the company's internet connection is frequently saturated. To identify the cause, the manager wants to determine which users, applications, and protocols are consuming the most bandwidth. The solution should be efficient and not require capturing the full content of every packet. Which technology is MOST effective for this purpose?
- Syslog
- SNMP
- Traceroute
- NetFlow (Correct answer)
Correct answer: NetFlow
NetFlow (and similar technologies like IPFIX and sFlow) is designed to collect and analyze metadata about IP traffic flows without capturing the packet payloads. [1, 10] It provides information on source/destination IPs, ports, protocols, and the volume of data transferred, making it ideal for identifying top talkers and analyzing bandwidth usage. SNMP can provide interface utilization but lacks this level of detail. Syslog is for event logs, and Traceroute maps network paths.
Question 6: A company is experiencing poor quality on its Voice over IP (VoIP) calls, with users reporting that conversations sound choppy and garbled. A network analysis reveals that the arrival time between consecutive data packets is highly variable. Which network performance metric BEST describes this condition?
- Jitter (Correct answer)
- Latency
- Bandwidth
- Packet loss
Correct answer: Jitter
Jitter is the variation in the delay of received packets. [17, 18, 22] In real-time applications like VoIP, a consistent, predictable stream of packets is crucial. High jitter means packets arrive at irregular intervals, causing audio to sound choppy or distorted. Latency is the total delay, bandwidth is the link capacity, and packet loss is when packets fail to arrive entirely.
Free CompTIA Network+ Network Monitoring and Logging Questions and Answers 1
A network administrator needs to centralize log messages from various multi-vendor network devices like routers, switches, and firewalls into a single server for analysis.
The solution must use a standard, widely supported protocol for sending these event messages across the network.
Which protocol is BEST suited for this purpose?