SCP-500 Case Studies & Practical Application 5 — Questions and Answers
Question 1: A security team wants SolarWinds to detect when a new, unrecognized device connects to the corporate network and immediately trigger a ticket in their ITSM system. Which combination of SolarWinds features enables this?
- NPM interface utilization alerting + email to the ITSM helpdesk address
- SolarWinds UDT for rogue device detection + Orion alert with webhook/REST API integration to the ITSM (Correct answer)
- NCM config change detection + syslog forwarding to the ITSM
- IPAM IP conflict detection + SNMP trap forwarding
Correct answer: SolarWinds UDT for rogue device detection + Orion alert with webhook/REST API integration to the ITSM
UDT detects new MAC/IP entries on switch ports, and Orion's alerting engine can call a webhook or REST endpoint to auto-create ITSM tickets on detection.
Question 2: An engineer is troubleshooting why a remote branch site sees high latency to the data center. Using SolarWinds NPM, they check the WAN interface and see utilization at 40%. What should they investigate next?
- Replace the WAN circuit with a higher-capacity link immediately
- Use NetFlow Traffic Analyzer to check for a single high-volume flow or application causing the latency (Correct answer)
- Increase SNMP polling frequency to capture faster fluctuations
- Configure QoS on the WAN router and restart the interface
Correct answer: Use NetFlow Traffic Analyzer to check for a single high-volume flow or application causing the latency
Low average utilization can hide bursty traffic from a single flow; NTA flow data reveals if a short-duration burst is causing latency even at 40% average utilization.
Question 3: A SolarWinds deployment spans three geographic sites. Users at the remote sites complain that adding a node takes over 60 seconds. What architectural change would MOST improve this experience?
- Increase the SQL Server memory allocation on the main Orion server
- Deploy Additional Web Servers (AWS) at the remote sites to serve the Orion web console locally (Correct answer)
- Reduce the number of monitored nodes to lower database query load
- Switch from HTTPS to HTTP to reduce SSL overhead
Correct answer: Deploy Additional Web Servers (AWS) at the remote sites to serve the Orion web console locally
SolarWinds Additional Web Servers serve the Orion UI from a local server, reducing WAN latency for remote users interacting with the console.
Question 4: After a firewall rule change, multiple SolarWinds monitors for a DMZ server start failing. The server is actually healthy. Without touching the firewall, how can the engineer confirm the specific blocked ports?
- Check the Orion alert log for the exact error messages returned by each failed monitor
- Run a port scanner from the Orion server against the DMZ server to identify blocked ports
- Review the firewall's syslog in SolarWinds Log Analyzer to see deny events for the Orion polling engine IP (Correct answer)
- Delete and re-add the DMZ node with fresh credentials
Correct answer: Review the firewall's syslog in SolarWinds Log Analyzer to see deny events for the Orion polling engine IP
Log Analyzer can ingest firewall syslog and filter deny events from the Orion polling engine's IP to the DMZ server, confirming exactly which ports the new rule is blocking.
Question 5: A large enterprise wants to use SolarWinds to monitor 50,000 nodes across 10 sites without overloading a single Orion server. Which Orion scalability feature is designed for this?
- Deploy multiple standalone Orion installations with separate databases per site
- Use the Orion Scalability Engine (distributed polling with a central Orion database and multiple polling engines) (Correct answer)
- Enable parallel SNMP polling on a single Orion server to handle more nodes simultaneously
- Limit monitoring to critical nodes only to stay within single-server capacity
Correct answer: Use the Orion Scalability Engine (distributed polling with a central Orion database and multiple polling engines)
Additional Polling Engines (APE) distribute polling workload across multiple servers while feeding a single central Orion database, enabling large-scale deployments.
Question 6: A SolarWinds administrator receives a complaint that an alert for 'high interface errors' fired, but the interface was in a scheduled maintenance window. What should the administrator check?
- Whether the alert's trigger condition excludes nodes in maintenance windows
- Whether the maintenance window was created at the node level but the alert is scoped to the interface (Correct answer)
- Whether the alert email server was misconfigured to send despite suppression
- Whether the polling engine was restarted during the maintenance window
Correct answer: Whether the maintenance window was created at the node level but the alert is scoped to the interface
Maintenance windows applied at the node level may not suppress alerts on child objects (interfaces, volumes) unless configured to apply to child elements as well.
Question 7: An organization uses SolarWinds IPAM and discovers that two servers were manually assigned the same IP address, causing a network conflict. What IPAM feature would have PREVENTED this situation proactively?
- IPAM's IP conflict detection alert, which fires after a duplicate IP is detected on the network
- IPAM integration with DHCP to enforce IP assignments and block manual duplicates (Correct answer)
- Regular IPAM subnet scan reports reviewed by the network team weekly
- SNMP traps from switches sent to IPAM when a duplicate MAC is seen
Correct answer: IPAM integration with DHCP to enforce IP assignments and block manual duplicates
Integrating IPAM with DHCP servers centralizes IP assignment control, preventing static IP conflicts by enforcing allocation through IPAM before addresses are assigned.
SCP-500 Case Studies & Practical Application 5
A security team wants SolarWinds to detect when a new, unrecognized device connects to the corporate network and immediately trigger a ticket in their ITSM system.
Which combination of SolarWinds features enables this?