201-01 Sample Questions Answers

Express

Standard Profiler

Enterprise Profiler

B and C

A, B, and C

WAN Optimization Benefits reports, Breakdown of business versus non-business application reports, QOS reports by interface and/or application.

WAN Optimization of all TCP protocols with more specific optimization of over 50 TCP Applications.

WAN reporting of TCP Protocols.

QOS shaping, User-based policies that will block not compliant traffic, WAN optimization reporting.

A new capture job is created on the Cascade Shark appliance.

A new trace clip is created on the Cascade Shark appliance, using the time frame that was specified for the Cascade Profiler traffic report, and including a filter for the IP addresses or TCP ports that the drill down was launched from.

A new trace clip is created on the Cascade Shark appliance, using the timeframe that was specified for the Profiler traffic report.

The underlying packets associated with the Cascade Profiler traffic report are downloaded to Wireshark.

The underlying packets associated with the Cascade Profiler traffic report are saved as a PCAP file on the Cascade Shark appliance.

Name followed by list of Ports

Name followed by several Subnets

Name followed by Subnet

Subnet followed by name

Name followed by Subnet followed by Port

A packet capture (pcap) file that is open on the local file system for analysis by Cascade Pilot.

A packet capture (pcap) file that is exported on to the Cascade Shark OS disk for analysis by Cascade Pilot.

A capture job that is suspended or stopped.

A time filter into a job trace.

An optional module that is licensed separately and not available in the Cascade Pilot Personal Edition (PE) product.

A module that automatically generates expert reports of traffic selection in PDF format.

The source of packet traffic – either a device or a packet capture file.

Network traffic analysis displays that can be applied to traffic.

Use out of the box report templates

Export any dashboard to PDF

With a right-click operation

All of the above

Inclusion of a pie chart

Inclusion of a flow list

Data resolution (1 min, 15 min, 1 hr, etc.)

Columns that are included in the summary table

Sort order of the summary table

All of the above

SNMPv1 Only

SNMPv2 Only

SNMPv1 and SNMPv2

SNMPv1 and SNMPv3

It is a cost effective way of collecting IP conversation details from existing routers in the network

It is a packet capture technology that allows remote monitoring of packets in the network

It is a logging protocol for security events

It provides information about the number of bits and packets per protocol between each pair of IP Addresses across a device

It provides details such as response time and application level transactions across the network

Security Events

Performance and Availability Events

Current Events

Unacknowledged Events

Public Events

Private Events

Per User Events

Number of connections per second

Average Response time

TCP resets

CPU and memory utilization of server

TCP retransmission

Number of jumbo frames

Cascade Gateway’s poll Netflow sources via SNMP, while Cascade Profiler, Cascade Gateway and Cascade Sensor sync NTP from a common source.

Cascade Profiler’s poll Netflow sources via SNMP, while Cascade Profiler, Cascade Gateway and Cascade Sensor sync NTP a common source.

Cascade Profiler’s poll Netflow sources via SNMP, while Cascade Profiler is the NTP source for Cascade Gateways and Cascade Sensors.

Cascade Gateway’s poll Netflow sources via SNMP, while Cascade Profiler is the NTP source for Cascade Gateways, Cascade Sensors and Cascade Sharks.

SNMP polling is not supported in Cascade.

Cascade Shark appliance can monitor 10GE interface traffic but Cascade Sensor cannot.

Cascade Sensor can provide flow data to Cascade Profiler but Cascade Shark appliance cannot.

Cascade Shark appliance has much higher write-to-disk rates than the Cascade Sensor and is the appropriate appliance when packet capture is the primary requirement.

Cascade Sensor can recognize the application type by its DPI signature database but Cascade Shark appliance cannot.

There is a 30-minute waiting period before newly added users become active.

The user is probably using an unsupported web browser.

The user is probably lacking the Access permission.

None of the above.

Roll remote devices via SNMP at the request of NetProfiler.

Process up to tens of millions of raw flows per minute.

Provide analysis of incoming flows and identify anomalies in traffic patterns.

Selectively forward flows from original sources to third party colectors.

Selectively forward flows from original sources to NetProfiler(s).

ByLocation

ByHostGroup

ByPortsAndApplications

ByFunction

ByTimeZone

Application Performance, Interface Performance, and Security.

Application Performance, Application Availability, Interface Performance, and Interface Availability.

Application Performance, and Interface Performance.

Application Performance, Application Availability, Interface Performance, Interface Availability, Service Monitoring and Security.

SAN and Local Disk Storage

SAN only

Local Gateway-Storage

Hard Drive and Ethernet or USB-attached NAS

Local only

AppResponse

HP OpenView

NetProfiler

NetExpress

Flow Gateway

Packet Collection Only

Flow Collection Only

SNMP Statistics Only

Flow Collection or Packet Collection

SNMP Statistics or Packet Collection

Drag the trace file on the View to apply the View.

Right-click the View item and select "Apply with Filter".

Drag a View on the trace file to apply the selected View.

Select the View and the trace file, and double-click the trace file.

MGCP

SCCP

H.248

SIP

H323

HTTP over TCP/80 and HTTPS over TCP/445

HTTP over TCP/80 and HTTPS over TCP/443

HTTP over TCP/443 and HTTPS over TCP/80

HTTP over TCP/445 and HTTPS over TCP/80

HTTP over TCP/88 and HTTP over TCP/444

Two trace clips, the first has two views applied, the second has one view applied.

Two capture job traces, the first has two trace clips associated with it, the second has one trace clip associated with it.

Two Cascade Shark appliances, the first has two capture jobs, the second has one capture job.

Two packet capture (pcap) files, the first has two trace clips associated with it, the second has one trace clip associated with it.

SAN HBA Protocol

TCP Protocols such as HTTP and HTTPS

UDP Protocols such as SMTP and Video streaming

IPv4 Protocols including TCP, UDP, and ICMP

IPv4 Protocols such as x.25, TTY and TTL

Drives are Failing/Missing

RAID is Rebuilding

Partitions are not mounted or mounted as read-only.

Drives are OK.

Drives have Low/No Space.

Virtualization and Data Center Mobility

Rationalization and Irrationalization

Virtualization and Data Center Consolidation

Remote Site monitoring and Packet Exportation

Data Import and Data Export

User

Port/Group

Interface/Device

Applications

QoS

All the above

Windows Server 2003 or Windows Server 2008

Windows XP, Windows Vista, or Windows 7

Cascade Pilot is not specific to an operating system since access is through any standard web browser.

Any operating system supported by Wireshark

Compare the amount of traffic crossing a LAN interface to the corresponding traffic crossing an optimized WAN interface.

Compare updates received via SNMP from Steelhead optimization devices with router devices.

The Cascade Profiler cannot determine optimization levels.

Through manual entry of levels achieved.

Compare updates received via flows from Steelhead optimization devices with router devices.

1000Mbps

any speed, it does not matter.

10000Mbps

10Mbps

100Mbps

Manually created hosts are not monitored

Manually created relationships are not monitored

Thresholds need to be set

All of the above

You MUST connect to the Cascade Shark through its web interface, export packets to a packet capture (pcap) file, then from within Cascade Pilot you can open the pcap file.

You MUST use a Cascade Gateway to view packet data on Cascade Shark.

You MUST use a Cascade Profiler to view packet data on Cascade Shark.

You can simply connect to the Cascade Shark appliance directly from Cascade Pilot provided that proper network communication is available between Cascade Pilot and Cascade Shark.

You can simply connect to the Cascade Shark appliance directly from Cascade Pilot provided that a capture job has already been configured from the Cascade Shark Web Interface and proper network communication is available.

Cascade gateway

Cascade Pilot software

Wireshark software

Cascade Sensor

Cascade Shark

Through RADIUS server(s)

From Domain Controller(s)

Through standards-based LDAP queries

Via SNMP queries

A downloadable customized view from the online Cascade community.

Any view that is applied to live devices and dynamically updated.

A view that can be created after drill-down from one view to another.

Any view that was created by applying a traffic filter.

All views within Cascade Pilot are considered interactive views.

Provide structure in the application model

Manually created

Can be expanded or collapsed

All of the above

Know the time span analyzed by the View.

Want to change the time selection covered by the View.

Change the resolution of a strip chart.

Analyze more than one trace file.

ARP

ICMP

UDP

TCP

AppleTalk

Ethernet

Configuration

Setup Page

UI Preference

Personal Dashboard

Configuration/General Settings

Using the Primary DNS server obtained via DHCP from the Cascade Profiler’s management interface.

Using the Secondary DNS server obtained via DHCP from the Cascade Profiler’s management interface.

Using the Tertiary DNS server obtained via DHCP from the Cascade Profiler’s management interface.

Using the DNS server(s) as defined in the Configuration > General Settings page.

Using any DNS servers the Cascade Profiler auto-discovers in the Inside Address space, found in the Configuration > DNS Settings page.

Cascade Shark interfaces and captures job traces appear under the devices tab within the sources panel.

Cascade Shark interfaces appear under the devices tab of the sources panel AND Cascade Shark capture job traces appear under the files tab of the sources panel.

Cascade Shark interfaces and captures job traces appear in the views panel.

Cascade Shark interfaces must be selected from the home menu to begin a capture.

sFlow

Netflow (v5 and v9)

IPFIX

SteelFlow-Net sources

Syslog

Sensor

Express

Shark

Gateway

Gateway-VE

receive mail from others.

send reports.

send disk failure notifications.

send alerts.

Is a graphic object used to show selected and global time windows for the applied View.

Can be applied to both live captures and saved pcap files.

Is a feature that allows a user to be notified when a specified event occurs on the network.

Can send a syslog message when an event is triggered.

You must run only a single version of the AD connector program.

Install the AD Connector 1.5 on all domain controllers.

Install the appropriate version of the AD Connector on each domain controller.

Install the AD Connector v2.0 on all domain controllers.

Install the AD Connector v2.0 on an Event Collector host.

Maximum flow capacity.

Maximum number of operational analytics.

Maximum number of users supported.

Maximum number of available reports.

In UI preferences

In behavior analysis - policies

In behavior analysis - notifications

In behaviors analysis - events

In configuration - general settings

5.5

5.0

5.1

4.0

Wireshark

AD Connector

SNMP Connector

Syslog Collector

NetFlow v9

sFlow

Federated Data Records (FDR)

IPFix

CascadeFlow from Steelhead

All of the above

Cascade can determine every URL that a client goes to out on the internet.

Cascade can identify applications at Layer7 which will aid in determining business versus non-business use-age of resources.

Cascade can identify applications that use multiple common ports based upon Layer7 to more readily track application dependencies.

Cascade can be configured with URLs, match those URL’s to application names and, in order to understand which applications are utilized on web servers that host multiple web applications over the same TCP port.

Cascade can identify unencrypted applications such as FTP and TELNET regardless of port number, and other applications (such as Peer to Peer) that may violate a company’s security policies.

One or all views from the main workspace.

Notes entered associated with a view.

Analyst and Client information entered.

A and B.

A, B and C.

System->Devices & Interfaces

Configuration->Accounts

Definitions->Host Groups

Configuration->General Settings

Dashboard

By importing a display or capture filter from Wireshark.

By saving the filter applied in a View.

Only when you are connected to a Cascade Shark.

Only before applying a View.

Time from 1st ACK to 1st DATA.

Time from (SYNACK to 1st DATA) – client delay.

Time from SYN to 1st DATA.

Time from SYN to 1st ACK.

Identity integration to identify which users are logged into which client machines.

Integration with synthetic transaction tools to obtain response time information.

A fully functional CLI that is easier to use than a Web based GUI.

A Web based GUI that does not require a password or HTTPS connection allowing for easier connection.

Ensuring the interface of the Cascade Profiler is on the same subnet as the router, as NetFlow is not routable.

Using the “tcp/(n) + 1” port numbering scheme to ensure this router’s NetFlow is unique from all other routers.

Ensuring the router has IP connectivity to the Cascade Gateway.

Ensuring the interface of the Cascade Gateway is on the same subnet as the router, as NetFlow is not routable.

Using the “udp/(n) + 1” port numbering scheme to ensure this router’s NetFlow is unique from all other routers.

Fault Management

Application Performance Management (APM)

Network Behavior Analysis (NBA)

Flow based Network Monitoring and Analysis

NetFlow v5

CascadeFlow

IPFix

cflowd

NetFlow v9

All of the above

SMTP or SNMP must be configured.

I have to have an account on Cascade.

Lotus Notes has to be installed.

I need a Riverbed e-mail account.

Seven days

Three days

It depends on the flow rate.

Twenty-four hours

None of the above

SNMP; Snap-Length

TAP; SNMP

TAP; Syslog

SNMP; NetFlow

Syslog; NetFlow

On Dashboards

In Reports

In User Defined Policies

In Application Performance Policies

All of the above

User-Defined Policies are used only to compare current traffic against fixed values while other policies may allow you to compare traffic against both fixed values and a baseline, depending on the type of policy.

User-Defined Policies can be used to compare current traffic against a baseline of traffic built over the past several days, weeks, and months, while other policies compare current traffic against fixed values only.

User-Defined Policies allow you to set a minimum amount that a policy must change by before an alert will be created, whereas other policies do not.

There are no specific differences between User-Defined Policies and other policies, except the names of the policies.

WAN Optimization

Data Center Consolidation

Router Configuration Management

Firewall Audit

Ten

Four

Unlimited

Twenty

2

4

6

8

12