FREE CompTIA Network+ Network Monitoring and Logging Questions and Answers

Question 1

A network administrator needs to centralize log messages from various multi-vendor network devices like routers, switches, and firewalls into a single server for analysis. The solution must use a standard, widely supported protocol for sending these event messages across the network. Which protocol is BEST suited for this purpose?

Accepted Answer

Syslog

Answer

Syslog is the industry standard protocol specifically designed for forwarding log and event messages from network devices to a central logging server. While SNMP can send 'traps' (notifications), its primary purpose is device management and monitoring of specific variables, not comprehensive logging. NetFlow is for collecting IP traffic metadata, and ICMP is for network diagnostics.

Question 2

In the Simple Network Management Protocol (SNMP) architecture, which component is a hierarchical database residing on a managed device that contains variables and objects the device can report on or be configured for?

Accepted Answer

Management Information Base (MIB)

Answer

The Management Information Base (MIB) is a database of manageable objects on a network device. [14, 25, 26] The SNMP Agent is the software on the device that responds to requests, the NMS is the console that sends requests, and a Trap is an unsolicited alert sent from the agent to the NMS.

Question 3

A security analyst needs to investigate a potential data breach by correlating firewall logs, web server access logs, and authentication logs from a domain controller. The goal is to identify suspicious patterns, such as a brute-force attack followed by unauthorized data access. Which system is specifically designed to aggregate, normalize, and correlate log data from multiple disparate sources for security analysis?

Accepted Answer

Security Information and Event Management (SIEM)

Answer

A Security Information and Event Management (SIEM) system is the correct tool for this task. Its core function is to collect, aggregate, and analyze log data from various security tools and network devices to provide a comprehensive view of an organization's security posture and enable threat detection through event correlation. [2, 3, 4, 5] An IDS is a source of logs, a protocol analyzer captures live traffic, and an NMS focuses on network performance monitoring.

Question 4

A network technician needs to perform a deep inspection of network traffic to diagnose a complex application issue. The technician wants to capture and view the individual headers and payloads of packets being sent to and from a specific server. What type of tool is required for this task?

Accepted Answer

Protocol analyzer

Answer

A protocol analyzer, also known as a packet sniffer (e.g., Wireshark), is designed to capture, decode, and display the contents of network packets, including their headers and payloads. [7, 8, 9] This allows for in-depth analysis of network communications. A throughput tester measures bandwidth, a log aggregator collects Syslog data, and a port scanner checks for open ports.

Question 5

A network manager has noticed the company's internet connection is frequently saturated. To identify the cause, the manager wants to determine which users, applications, and protocols are consuming the most bandwidth. The solution should be efficient and not require capturing the full content of every packet. Which technology is MOST effective for this purpose?

Accepted Answer

NetFlow

Answer

NetFlow (and similar technologies like IPFIX and sFlow) is designed to collect and analyze metadata about IP traffic flows without capturing the packet payloads. [1, 10] It provides information on source/destination IPs, ports, protocols, and the volume of data transferred, making it ideal for identifying top talkers and analyzing bandwidth usage. SNMP can provide interface utilization but lacks this level of detail. Syslog is for event logs, and Traceroute maps network paths.

CompTIA Practice Test

CompTIA Practice Test

FREE CompTIA Network+ Network Monitoring and Logging Questions and Answers