SolarWinds Certified Professional (SCP-500) — Questions and Answers

Question 1: In SolarWinds Observability, correlating metrics, logs, and traces across a hybrid environment primarily addresses which risk?

Blind spots that allow incidents to go undetected across service boundaries (Correct answer)
Unencrypted Telnet sessions
Excessive SNMP community string sharing
Unauthorized VPN connections

Correct answer: Blind spots that allow incidents to go undetected across service boundaries

Full-stack observability eliminates visibility gaps, so incidents spanning multiple technology layers are detected before they escalate.

Question 2: When configuring Network Configuration Manager (NCM) for compliance, which professional standard governs how configuration backups should be scheduled?

Real-time event-triggered backup plus a periodic full backup schedule (Correct answer)
Manual backup before each change only
Weekly full backup with no event triggering
On-demand backup initiated by the change manager

Correct answer: Real-time event-triggered backup plus a periodic full backup schedule

Combining event-triggered backups with periodic scheduled backups ensures both immediate post-change capture and regular baseline retention.

Question 3: When a new SolarWinds professional joins a team, what artifact most effectively enables them to become productive quickly?

A list of all monitored IP addresses
A comprehensive runbook covering architecture, alert logic, escalation paths, and common troubleshooting procedures (Correct answer)
Access to raw database exports
Training videos from SolarWinds Academy only

Correct answer: A comprehensive runbook covering architecture, alert logic, escalation paths, and common troubleshooting procedures

A well-maintained runbook provides operational context, decision rules, and institutional knowledge that accelerates time-to-competency for new team members.

Question 4: What SolarWinds feature allows you to view the path packets take between two network endpoints and measure per-hop latency?

SAM component monitor
IPAM subnet scan
Network Atlas map
Path Analysis / NetPath (Correct answer)

Correct answer: Path Analysis / NetPath

NetPath (Path Analysis) performs continuous hop-by-hop probing, displaying latency and loss at each point along the network path.

Question 5: Which SolarWinds module is primarily used for monitoring network bandwidth utilization and interface statistics?

Network Performance Monitor (NPM) (Correct answer)
Server & Application Monitor (SAM)
Network Configuration Manager (NCM)
IP Address Manager (IPAM)

Correct answer: Network Performance Monitor (NPM)

SolarWinds NPM collects and analyzes bandwidth and interface statistics across network devices using SNMP and NetFlow.

Question 6: During capacity planning discussions, a stakeholder asks how bandwidth utilization has trended over the past 90 days on the primary internet link. Which SolarWinds report parameter configuration is needed?

Export the last 90 days of SNMP trap logs for the interface
Run a current utilization snapshot and extrapolate manually
Set the report time range to 90 days and filter by the specific interface on the internet-facing device (Correct answer)
Use Network Configuration Manager to pull interface counters from the device

Correct answer: Set the report time range to 90 days and filter by the specific interface on the internet-facing device

SolarWinds interface reports support custom date range selection, allowing you to generate a 90-day utilization trend for any specific interface directly from collected data.

Question 7: What role does peer review play in SCP-500 - Solarwinds Certified Professional practice?

It creates unnecessary competition
It is only for beginners
It provides quality assurance and professional development through collegial evaluation (Correct answer)
It replaces formal certification

Correct answer: It provides quality assurance and professional development through collegial evaluation

This is fundamental to SCP-500 - Solarwinds Certified Professional practice. It provides quality assurance and professional development through collegial evaluation represents the professional standard for professional standards in the SCP-500 certification framework.

Question 8: Which SolarWinds Orion module would you use to monitor Quality of Service (QoS) markings and queuing on WAN interfaces?

Storage Resource Monitor
Web Performance Monitor
IP SLA Manager / QoS Monitor (Correct answer)
Network Configuration Manager

Correct answer: IP SLA Manager / QoS Monitor

QoS Monitor (part of IP SLA) tracks DSCP markings, queue depths, and drops to verify QoS policy effectiveness on WAN links.

Question 9: In SolarWinds NPM, which QA validation confirms that interface discovery is capturing all physical and logical interfaces on a monitored router?

Comparing discovered interface count in Orion with the interface count from the device's CLI (Correct answer)
Confirming that the polling engine has a route to the device
Verifying that the SNMP community string is read-write
Checking that the node shows status 'Up'

Correct answer: Comparing discovered interface count in Orion with the interface count from the device's CLI

Comparing the interface count in Orion against the CLI output (e.g., 'show interfaces summary') confirms that discovery captured all interfaces without gaps.

Question 10: A SolarWinds professional receives conflicting instructions from two managers regarding alert escalation procedures. What is the best course of action?

Choose whichever procedure seems most efficient
Escalate the conflict to both managers and request written clarification (Correct answer)
Follow the most senior manager's instructions
Document both instructions and follow the most recent one

Correct answer: Escalate the conflict to both managers and request written clarification

Escalating to both managers and requesting written clarification ensures accountability, avoids misunderstandings, and creates a documented decision trail.

Question 11: A QA team is auditing SolarWinds alert noise. Which configuration change most effectively reduces duplicate alerts for the same event during an outage?

Move to SNMP traps only
Disable all email notifications
Increase polling frequency
Enable alert suppression or reset conditions with time delays (Correct answer)

Correct answer: Enable alert suppression or reset conditions with time delays

Configuring alert reset conditions with appropriate time delays prevents the same alert from repeatedly firing during a sustained outage.

Question 12: When SolarWinds issues a 'high CPU' alert on a router, what underlying SNMP MIB object is typically being polled?

ifInOctets
ifOperStatus
ciscoProcessMIB or hrProcessorLoad (Correct answer)
sysUpTime

Correct answer: ciscoProcessMIB or hrProcessorLoad

CPU utilization is read from vendor-specific OIDs (e.g., Cisco's cpmCPUTotalTable) or the standard HR-MIB hrProcessorLoad object.

Question 13: What is the primary competency framework for SCP-500 - Solarwinds Certified Professional professionals?

Ad-hoc skill development
Self-assessed capabilities only
Employer-specific requirements only
Structured competency standards defined by the certifying body (Correct answer)

Correct answer: Structured competency standards defined by the certifying body

This is fundamental to SCP-500 - Solarwinds Certified Professional practice. Structured competency standards defined by the certifying body represents the professional standard for professional standards in the SCP-500 certification framework.

Question 14: Which SolarWinds Orion database is used to store all collected performance data, alerts, and configuration by default?

MySQL
Microsoft SQL Server (Correct answer)
SQLite
Oracle Database

Correct answer: Microsoft SQL Server

SolarWinds Orion requires Microsoft SQL Server as its backend database for storing all monitoring data and configuration.

Question 15: How should SCP-500 professionals prioritize identified risks?

Alphabetically
Based on likelihood of occurrence combined with severity of potential impact (Correct answer)
Randomly
By cost to mitigate only

Correct answer: Based on likelihood of occurrence combined with severity of potential impact

This is fundamental to SCP-500 - Solarwinds Certified Professional practice. Based on likelihood of occurrence combined with severity of potential impact represents the professional standard for risk management in the SCP-500 certification framework.

Question 16: Which polling protocol does SolarWinds Orion use to monitor Windows servers without requiring SNMP to be enabled?

Telnet
ICMP
WMI (Correct answer)
TFTP

Correct answer: WMI

WMI (Windows Management Instrumentation) is a native Windows technology that Orion uses to collect detailed CPU, memory, and service data from Windows systems agentlessly.

Question 17: An administrator finds that a monitored node's SNMP polling fails intermittently. Packet captures confirm the device responds, but Orion marks it 'down.' What is the MOST likely cause?

The polling engine's firewall is blocking outbound SNMP traps
The SNMP community string in Orion does not match the device (Correct answer)
The Orion database is full and dropping poll results
The node's CPU is too busy to generate SNMP responses

Correct answer: The SNMP community string in Orion does not match the device

A mismatched SNMP community string causes authentication failures that appear as intermittent or full polling failures even when the device is reachable.

Question 18: What SolarWinds IPAM capability detects conflicting or duplicate IP address assignments on the network?

Config compliance check
DHCP scope exhaustion warning
Subnet utilization alert
IP Conflict Detection (Correct answer)

Correct answer: IP Conflict Detection

IPAM's IP Conflict Detection identifies cases where two devices are using the same IP address, which causes connectivity issues and should be resolved immediately.

Question 19: A SolarWinds professional notices that a colleague has granted a junior analyst admin-level access to the Orion console 'to save time.' What is the correct professional response?

Revoke the access yourself immediately
Ask the junior analyst to self-restrict their usage
Report it to IT security as a policy violation and suggest proper role assignment (Correct answer)
Ignore it since the colleague is senior

Correct answer: Report it to IT security as a policy violation and suggest proper role assignment

Reporting the violation through proper channels and suggesting corrective action upholds least-privilege principles while respecting organizational process.

Question 20: Under FedRAMP, continuous monitoring requires vulnerability scanning at defined frequencies. Which SolarWinds integration supports this requirement?

SolarWinds WPM synthetic transactions
SolarWinds NPM bandwidth graphing
Integration with Tenable or Qualys via SolarWinds Orion SDK (Correct answer)
SolarWinds NCM config archiving

Correct answer: Integration with Tenable or Qualys via SolarWinds Orion SDK

SolarWinds Orion integrates with vulnerability scanners like Tenable/Qualys to provide unified visibility needed for FedRAMP continuous monitoring.

Question 21: What SolarWinds SAM feature displays upstream and downstream service dependencies to show which apps rely on which infrastructure?

Volume capacity chart
Config compliance report
Network Atlas topology
Application Dependency Map (Correct answer)

Correct answer: Application Dependency Map

The Application Dependency Map in SAM visualizes relationships between application tiers, helping identify cascading failure risks.

Question 22: Which SolarWinds feature allows administrators to create custom views of network data tailored to specific teams or roles?

EOC (Enterprise Operations Console)
NetPath
Custom SNMP Pollers
Orion Views (Correct answer)

Correct answer: Orion Views

Orion Views allow administrators to create role-specific dashboards that display relevant charts, maps, and resource lists for different teams.

Question 23: Which term describes the risk that remains after an organization has applied all planned security controls?

Gross risk
Residual risk (Correct answer)
Secondary risk
Inherent risk

Correct answer: Residual risk

Residual risk is what persists after mitigation measures are implemented and must be explicitly accepted or further treated.

Question 24: Under GLBA (Gramm-Leach-Bliley Act), financial institutions must implement safeguards to protect customer information. Which SolarWinds capability MOST directly supports this?

SAM CPU utilization polling
Security Event Manager correlation rules detecting unauthorized data access (Correct answer)
IPAM DHCP lease tracking
NPM traffic throughput graphing

Correct answer: Security Event Manager correlation rules detecting unauthorized data access

SolarWinds Security Event Manager detects and alerts on unauthorized access attempts, directly supporting GLBA Safeguards Rule requirements.

Question 25: How do SCP-500 professionals establish measurable quality objectives?

Through subjective assessment
By defining specific, measurable, achievable, relevant, and time-bound quality targets (Correct answer)
By comparing to competitors only
Using vague goals

Correct answer: By defining specific, measurable, achievable, relevant, and time-bound quality targets

This is fundamental to SCP-500 - Solarwinds Certified Professional practice. By defining specific, measurable, achievable, relevant, and time-bound quality targets represents the professional standard for quality in the SCP-500 certification framework.

Question 26: In SolarWinds Orion, what is the purpose of a 'Network Atlas' map?

Report template for executive dashboards
Scheduled task for firmware updates
Database schema for node storage
Visual topology map showing device relationships and status (Correct answer)

Correct answer: Visual topology map showing device relationships and status

Network Atlas provides a visual, interactive map of the network topology where node icons reflect real-time status colors.

Question 27: A healthcare organization must comply with HIPAA's Technical Safeguard for automatic logoff. How can SolarWinds SAM help verify this control?

By monitoring session timeout settings on application servers (Correct answer)
By tracking IP address conflicts
By scanning network bandwidth utilization
By generating network topology diagrams

Correct answer: By monitoring session timeout settings on application servers

SAM can monitor application-level metrics and alert when session timeout configurations are not set correctly on healthcare application servers.

Question 28: In a SolarWinds quality assurance review of multi-vendor environments, which protocol configuration ensures accurate hardware health data (fans, power supplies, temperature) is collected from non-Cisco devices?

Using ICMP-only polling for non-Cisco devices
Enabling WMI polling on all devices
Relying on Syslog messages for hardware health status
Configuring vendor-specific SNMP MIBs and custom pollers for OIDs unique to each hardware platform (Correct answer)

Correct answer: Configuring vendor-specific SNMP MIBs and custom pollers for OIDs unique to each hardware platform

Non-Cisco hardware health OIDs reside in vendor-specific MIBs; loading these MIBs and creating custom pollers ensures accurate hardware health data collection.

Question 29: In SolarWinds Network Performance Monitor, which threshold type triggers an alert based on a calculated baseline rather than a fixed value?

Manual override threshold
Absolute threshold
Static threshold
Dynamic baseline threshold (Correct answer)

Correct answer: Dynamic baseline threshold

Dynamic baseline thresholds adapt to normal traffic patterns and alert when deviations exceed a configured percentage or standard deviation.

Question 30: Which professional practice should govern the retirement of a monitored node from SolarWinds?

Archive historical data, remove alerts referencing the node, then delete it following a defined offboarding checklist (Correct answer)
Transfer node ownership to a junior team member
Delete the node immediately once decommissioned
Leave the node in an unmanaged state indefinitely

Correct answer: Archive historical data, remove alerts referencing the node, then delete it following a defined offboarding checklist

A structured offboarding checklist ensures historical data is preserved, dependent alerts are cleaned up, and the removal is auditable.

Question 31: When SolarWinds NCM detects that a device configuration has changed outside of a maintenance window, the recommended risk response is to:

Generate an alert and compare the running config against the approved baseline (Correct answer)
Increase SNMP polling frequency
Immediately reboot the device
Delete the device from NCM inventory

Correct answer: Generate an alert and compare the running config against the approved baseline

Comparing the changed configuration to the approved baseline identifies unauthorized modifications so they can be reverted or approved.

Question 32: In SolarWinds, what is the purpose of 'Hardware Health Monitoring' within SAM?

Monitor fan speed, temperature, and power supply status via IPMI or vendor agents (Correct answer)
Analyze virtualization CPU ready queues
Track application transaction response times
Generate compliance configuration reports

Correct answer: Monitor fan speed, temperature, and power supply status via IPMI or vendor agents

Hardware Health Monitoring collects physical sensor data (fans, temps, PSU, drives) from servers through IPMI, Dell iDRAC, or HP iLO interfaces.

Question 33: Which SolarWinds professional competency is demonstrated by creating custom SQL queries in SWQL Studio to fill reporting gaps?

Platform administration
Vendor management
Network engineering
Advanced data literacy and platform extensibility (Correct answer)

Correct answer: Advanced data literacy and platform extensibility

Writing SWQL queries to address reporting gaps demonstrates advanced data literacy and the ability to extend platform capabilities beyond out-of-box features.

Question 34: Which SolarWinds NPM capability allows administrators to group monitored devices into logical collections for reporting and alerting?

SNMP community strings
Custom properties and groups (Correct answer)
Trap receivers
Credential library

Correct answer: Custom properties and groups

Custom properties (e.g., location, department) and node groups allow logical segmentation of devices for targeted alerts and reports.

Question 35: A SolarWinds administrator needs to demonstrate that privileged access to network devices is monitored per CIS Control 6. Which tool provides this evidence?

NPM interface availability graphs
NCM audit logs of device login activity (Correct answer)
VMAN virtual machine capacity reports
WPM user journey recordings

Correct answer: NCM audit logs of device login activity

CIS Control 6 requires controlled use of administrative privileges, and NCM logs all authenticated access and changes to network devices.

Question 36: A SolarWinds professional is asked to prove that an outage did not affect a specific application tier. Which feature provides the most credible evidence?

Availability reports from SolarWinds with polling timestamps for the relevant nodes (Correct answer)
Verbal confirmation from the on-call engineer
Event log exported to spreadsheet
A screenshot of the current dashboard showing green status

Correct answer: Availability reports from SolarWinds with polling timestamps for the relevant nodes

Time-stamped availability reports provide auditable, platform-generated evidence that is far more credible than manual records or current-state screenshots.

Question 37: Which SolarWinds tool is specifically designed to provide hop-by-hop path analysis, helping gather evidence about where in a network path latency is introduced?

WPM (Web Performance Monitor)
NTA (NetFlow Traffic Analyzer)
IPAM
NetPath (Correct answer)

Correct answer: NetPath

NetPath performs continuous hop-by-hop path tracing, visually identifying where latency or packet loss is introduced along a network path.

Question 38: A SolarWinds NCM compliance report shows a router config deviating from a baseline. Under NIST 800-53, which control family does this fall under?

Configuration Management (CM) (Correct answer)
Incident Response (IR)
Audit and Accountability (AU)
Access Control (AC)

Correct answer: Configuration Management (CM)

NIST 800-53 Configuration Management (CM) controls govern baseline configurations and deviation detection.

Question 39: Which NIST Cybersecurity Framework function does SolarWinds Network Performance Monitor MOST directly support?

Recover
Identify
Respond
Detect (Correct answer)

Correct answer: Detect

NPM continuously monitors network anomalies and generates alerts, directly supporting the NIST CSF 'Detect' function.

Question 40: In SolarWinds, a 'node down' alert is generated based on which underlying check?

Syslog message receipt
ICMP ping response failure (Correct answer)
NetFlow export interruption
CPU threshold exceeded

Correct answer: ICMP ping response failure

SolarWinds uses ICMP echo requests (ping) to determine node availability; consecutive failures trigger a node-down alert.

Question 41: A SolarWinds deployment spans three geographic sites. Users at the remote sites complain that adding a node takes over 60 seconds. What architectural change would MOST improve this experience?

Deploy Additional Web Servers (AWS) at the remote sites to serve the Orion web console locally (Correct answer)
Reduce the number of monitored nodes to lower database query load
Increase the SQL Server memory allocation on the main Orion server
Switch from HTTPS to HTTP to reduce SSL overhead

Correct answer: Deploy Additional Web Servers (AWS) at the remote sites to serve the Orion web console locally

SolarWinds Additional Web Servers serve the Orion UI from a local server, reducing WAN latency for remote users interacting with the console.

Question 42: In SolarWinds NPM, what metric represents the percentage of transmitted packets that did not reach their destination?

Interface utilization
Polled discards
Response time (ms)
Packet loss percentage (Correct answer)

Correct answer: Packet loss percentage

Packet loss percentage is calculated from ICMP probes or interface counters and indicates network path quality.

Question 43: Which database platform does the SolarWinds Orion Platform natively support?

MySQL
Oracle Database
PostgreSQL
Microsoft SQL Server (Correct answer)

Correct answer: Microsoft SQL Server

SolarWinds Orion Platform uses Microsoft SQL Server as its backend database.

Question 44: Which SolarWinds Orion log entry level indicates a critical system error that requires immediate quality investigation?

Informational
Verbose
Error (Correct answer)
Warning

Correct answer: Error

Error-level log entries in Orion indicate failures in polling, database writes, or module operations that need immediate attention.

Question 45: A QA engineer wants to verify SolarWinds data accuracy by comparing polled SNMP values against device CLI output. Which SolarWinds tool provides raw SNMP polling results for a specific OID?

Alert log viewer
Node Details widget
SNMP MIB Walker (Correct answer)
Real-time interface chart

Correct answer: SNMP MIB Walker

The SNMP MIB Walker lets you query specific OIDs directly and compare returned values with device CLI output.

Question 46: When SolarWinds NPM sends a 'node down' alert but the node is actually reachable, this is called a:

True negative
False negative
False positive (Correct answer)
True positive

Correct answer: False positive

A false positive alert fires when no actual problem exists, which can erode trust in the monitoring system if not addressed.

Question 47: During a SolarWinds deployment QA review, you discover that packet loss data shows 100% loss for an interface that is clearly operational. What is the most likely cause?

License limit exceeded for interfaces
Incorrect SNMP community string
ICMP blocked by an ACL on the monitored device (Correct answer)
Polling interval set too high

Correct answer: ICMP blocked by an ACL on the monitored device

If ICMP is blocked by an ACL, SolarWinds interprets lack of ping response as 100% packet loss even when the device is reachable via SNMP.

Question 48: A change management board requires proof that a router's configuration was reviewed before a scheduled change. Which SolarWinds capability provides this documentation?

NetFlow report for the router's interface during the previous week
NCM configuration baseline comparison report showing pre-change state (Correct answer)
SAM report listing running processes on the router
SolarWinds IPAM address allocation history

Correct answer: NCM configuration baseline comparison report showing pre-change state

NCM stores configuration baselines and allows before-and-after comparisons, giving change management boards documentary evidence of the pre-change configuration state.

Question 49: Which SolarWinds SIEM feature BEST supports PCI DSS Requirement 11.4 (intrusion detection/prevention techniques)?

Security Event Manager real-time correlation rules (Correct answer)
IPAM rogue DHCP detection
NPM packet capture
NCM baseline deviation reports

Correct answer: Security Event Manager real-time correlation rules

SolarWinds Security Event Manager applies real-time correlation rules to detect intrusion patterns, directly addressing PCI DSS Requirement 11.4.

Question 50: How should an SCP-500 professional handle an outcome that differs from expectations?

Analyze contributing factors, document findings, and adjust approach based on lessons learned (Correct answer)
Repeat the same approach
Blame external factors
Ignore the discrepancy

Correct answer: Analyze contributing factors, document findings, and adjust approach based on lessons learned

This is fundamental to SCP-500 - Solarwinds Certified Professional practice. Analyze contributing factors, document findings, and adjust approach based on lessons learned represents the professional standard for practical in the SCP-500 certification framework.

Question 51: Which SolarWinds Orion setting, if misconfigured, would cause all nodes to appear with incorrect 'Last Boot' times during a QA infrastructure review?

SNMP polling interval
Time zone setting on the Orion server or polling engine (Correct answer)
Database connection pool size
Alert notification delay

Correct answer: Time zone setting on the Orion server or polling engine

If the Orion server or polling engine has an incorrect time zone, timestamps for metrics including 'Last Boot' will be offset, causing misleading data in reports.

Question 52: Which compliance standard requires organizations to perform risk assessments before and after significant IT changes, which SolarWinds NCM can help document?

ISO 27001 clause 6.1
HIPAA Security Rule §164.308
All of the above (Correct answer)
PCI DSS Requirement 6

Correct answer: All of the above

ISO 27001, PCI DSS, and HIPAA all require risk assessment processes around significant changes, and NCM's change documentation supports all three frameworks.

Question 53: During a QA review of SolarWinds alerting, you discover alerts are being triggered but emails are not being delivered. Which component should be investigated first?

Orion SMTP notification settings and mail server connectivity (Correct answer)
Node polling interval configuration
Alert threshold values
Database storage capacity

Correct answer: Orion SMTP notification settings and mail server connectivity

Email delivery failures in SolarWinds alerts are most commonly caused by misconfigured SMTP settings or connectivity issues between the Orion server and the mail relay.

Question 54: A financial institution using SolarWinds needs to prove network device changes were authorized before implementation. Which framework's change management requirement does this address?

HIPAA Privacy Rule
FedRAMP Low baseline
SOX ITGC controls (Correct answer)
GDPR Article 17

Correct answer: SOX ITGC controls

SOX IT General Controls (ITGC) require authorized change management processes, which NCM's change tracking directly supports.

SolarWinds Certified Professional (SCP-500)

The SolarWinds Certified Professional (SCP-500) exam validates expertise in SolarWinds network management and monitoring products, covering configuration, performance analysis, alerting, compliance, and troubleshooting across enterprise IT environments. It is a retired foundational certification code, replaced by product-specific SCP exams.

Questions

90 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds