Network General Corp 1T6-111

Troubleshooting and Management with Sniffer Distributed

Version 1.0
QUESTION NO: 1

A possible cause(s) for Local Routing is:

A. A and B

B. The Time-to-Live field has reached zero

C. A protocol other than RIP is being used to circulate routing information

D. The router may be used for security purposes, to control access to particular parts of the network

Answer: D

QUESTION NO: 2

The most common method of stopping a capture is?

A. Stop and Display

B. Pause

C. Stop

D. View

Answer: A

QUESTION NO: 3

Webconsole is only supported on ________ agents

A. Ethernet and Gigabit

B. Ethernet and Token Ring

C. Ethernet and ATM

D. Ethernet and HSSI

Answer: A

QUESTION NO: 4

In Unattended mode, what does the Sniffer Distributed Agent do?

A. None of the above

B. Cancels any enabled captures when no consoles are logged in

C. Triggers packet captures and records statistics to the database when no consoles are logged in

D. Continues any enabled capture and records statistics to the database when no consoles are logged in

Answer: D

QUESTION NO: 5

A possible cause(s) for Local Routing is:

A. A and B

B. The router may be used for security purposes, to control access to particular parts of the network
C. The Time-to-Live field has reached zero

D. A protocol other than RIP is being used to circulate routing information

Answer: B

QUESTION NO: 6

In Sniffer mode, what does the Sniffer Distributed Agent do?

A. Performs standard RMON1 and RMON 2 monitoring

B. Captures and records statistics when no agents are logged in

C. All of the above

D. Performs packet capture, Expert analysis, and decodes

Answer: D

QUESTION NO: 7

When do File > Open and load in a file from the agent folder:

A. you can only save it back to a folder named using the template agent name;IP address

B. you can save it back to either the agent or console folder

C. your only option is to save it back to the console folder

D. your only option is to save it back to the agent folder

Answer: D

QUESTION NO: 8

What protocol does the Distributed Appliance used to communicate with the console? :

A. WCOM

B. SCOM

C. JOCM

D. DCOM

Answer: D

QUESTION NO: 9

Below is an image of the SniffView toolbar.

Which icon represents the Connect to Agent Selected in Agent List function?

A. G

B. C

C. A

D. B
Answer: C

QUESTION NO: 10

What does the ProbViewer Stat tab show?

A. A list of monitor adapters, their activity and logged-in users

B. Information about Host, Matrix and Protocol Distribution activities between Agent and Console

C. Information about Dashboard and History Sample activities between Agent and Console

D. Information about Packet Generator and filtered capture activities between Agent and Console

Answer: C

QUESTION NO: 11

With Sniffer Distributed RMON+ :

A. Has the same functionality as Expert

B. Has no support for Expert Analysis Add-on

C. Capture and decode occurs and stays at the Sniffer Distributed Appliance, not the console

D. Capture and decode does not occur

Answer: C
QUESTION NO: 12

Enter the user's console IP address into the New User configuration if you:

A. Intend to assign him/her administrator rights

B. Are assigning remote configuration privileges

C. Reset the passive user's statistics

D. Want to restrict user access to console(s)

Answer: D

QUESTION NO: 13

What is a possible cause for Too Many Retransmissions Diagnoses?

A. The ACKs were being transmitted via a slower path

B. The node is using expired or canceled routes

C. The analyzer has not been configured correctly to know it's own subnet address

D. A protocol other than RIP is being used to circulate routing information.

Answer: A

QUESTION NO: 14

A Sniffer Distributed Appliance requires which two adapters?

A. WANE and WANT

B. Monitor and Transport

C. Transport and WANE

D. Transport and LM2000

Answer: B

QUESTION NO: 15

Capturing Sniffer data and gathering statistics from the network segment is the function of which of the
following?

A. Console adapter

B. Transport adapter

C. Monitor adapter

D. RD32 agent

Answer: C

QUESTION NO: 16

What do you use the SniffView Quick Connect option to do?

A. Connect to an agent that is not defined in the Agent List

B. Connect to an agent automatically with the configured user name and password
C. Override the default user name and password defined for an agent in the Agent List

D. Connect as a new, active Agent

Answer: A

QUESTION NO: 17

The protocols for the Protocol Distribution statistics include the following layers:

A. Presentation, Session, Application

B. Physical, Session, Application

C. Network, Transport, Session

D. Network, Transport, Application

Answer: D

QUESTION NO: 18

When SniffView connects to an agent, the console screen shows which familiar interface?

A. ProbView

B. Sniffer Distributed RMON

C. Chat Pane

D. Sniffer Portable
Answer: D

QUESTION NO: 19

The LT2 Virtual Adapter allows the Ethernet card to act as a pass-through for what kind of frames?

A. Token Ring frames

B. WAN frames

C. Ethernet frames

D. ATM frames

Answer: D

QUESTION NO: 20

What user access allows a passive Console user to view a trace file or an active capture session
simultaneously with another console user?

A. Remote User

B. Frame sharing

C. Groupware

D. Passive User

Answer: C
QUESTION NO: 21

True or false? VirusScan is installed on all our 4.3.X Appliances.

A. False

B. True

Answer: B

QUESTION NO: 22

When do alarms occur?

A. When segment Monitor or Expert thresholds are exceeded

B. When Expert analysis detects a diagnosis

C. All of the above

D. When the alarm option is enabled in the Agent

Answer: C

QUESTION NO: 23

What does the ATMbook attach to?

A. A and B

B. Neither of the above

C. 10/100 Ethernet adapter

D. Token Ring adapter

Answer: C

QUESTION NO: 24

____ is a protocol that enables software components to communicate directly over a network in a
reliable, secure and efficient manner.

A. Distributed Console Out-of Band

B. Distributed Component Object Model

C. None of the above

D. Distributed Communication Module

Answer: B

QUESTION NO: 25

Connect, Connect as Different User, and Quick Connect are three methods used in SniffView to do
what?

A. Quick connect to an agent not in agent list

B. Connect to agents via SniffView

C. Connect to agents via RD32

D. Connect to agents via ProbView

Answer: B

QUESTION NO: 26

In the Sniffer Expert analyzer, among other fields the Global Objects include counts for ____ and ____?

A. Net Station 1 and Net Station 2

B. Protocol and Remote frames

C. frames and bytes

D. IP addresses and DLC addresses

Answer: C

QUESTION NO: 27

True or false? Because an agent attaches to the network like any other networked device, it will hear
only the traffic coming over that segment.

A. False

B. True

Answer: B

QUESTION NO: 28
ProbViewer sets the parameters for the operation and access of which of the following?

A. Monitor

B. Agent

C. Console and Agent

D. Console

Answer: B

QUESTION NO: 29

If a protocol other than RIP is being used to circulate routing information then a ____ Diagnoses will
result.

A. None of the above

B. Too Many Retransmissions

C. Window Frozen

D. Local Routing

Answer: A

QUESTION NO: 30

Sniffer Distributed includes ____ monitoring functions.

A. 10
B. 6

C. 8

D. 4

Answer: C

QUESTION NO: 31

If you do not have Control Session privileges, you:

A. Can connect as an active user if no one else is logged in

B. Can connect only as a passive user

C. A and B

D. Can be bumped off by a user with Control Session privileges

Answer: C

QUESTION NO: 32

What are SniffView, Trap Capture, and Alarm Manager applications of?

A. Sniffer Distributed Manager

B. Sniffer Distributed ProbView

C. Sniffer Distributed Console

D. Sniffer Distributed Agent

Answer: C

QUESTION NO: 33

What does ORP C PA=[128.1.0.1] PRO=IP indicate in a protocol conversation.

A. The station sending this frame is 128.1.0.1

B. None of the above

C. The station sending this frame is the server

D. The station sending this frame is the client

Answer: D

QUESTION NO: 34

When deploying Sniffer Distributed in your network, where should Sniffer analyzers be placed?

A. All of the above

B. On WAN connections

C. On critical ports and segments

D. On backbones and uplinks

Answer: A
QUESTION NO: 35

Below is an image of the SniffView toolbar.

Which icon represents the Add Agent/Group function?

A. B

B. E

C. A

D. D

Answer: D

QUESTION NO: 36

The Console and Appliance connect using:

A. UDP port 262

B. TCP port 262

C. UDP port 2001

D. TCP port 2001

Answer: C
QUESTION NO: 37

True or false? Whenever the agent is running, it is monitoring the network.)

A. True

B. False

Answer: A

QUESTION NO: 38

What do you use the SniffView Connect as Different User option to do?

A. Connect to an agent that is not defined in the Agent List

B. Connect as a new, active Agent

C. Connect to an agent automatically with the configured user name and password

D. Override the default user name and password defined for an agent in the Agent List

Answer: D

QUESTION NO: 39

Communicating with the console to control the agent and sending data to third party RMON
applications are functions of which adapter?
A. WANE

B. Monitor

C. LANE

D. Transport

Answer: D

QUESTION NO: 40

Below is an image of the SniffView toolbar.

Which icon represents the Delete Selected Agent/Group function?

A. E

B. H

C. G

D. F

Answer: D

QUESTION NO: 41
If a protocol other than RIP is being used to circulate routing information then a ____ Diagnoses will
result.

A. Local Routing

B. None of the above

C. Window Frozen

D. Too Many Retransmissions

Answer: B

QUESTION NO: 42

Which of the following is true about monitor adapters?

A. A and B

B. Communicate with the console to control the agent

C. Attach to the network to gather Sniffer data

D. Send data to third party RMON applications

Answer: C

QUESTION NO: 43

You should disable all protocols except Sniffer Driver 4.3.X when configuring which adapters?

A. Transport adapters
B. Monitor adapters

C. Console adapters

D. LM2000 adapters

Answer: B

QUESTION NO: 44

Which of the following is true about RMON+ ?

A. B and C

B. is capable of capturing traffic but not monitoring

C. RMON+ capture can be looked at by an agent with the Expert option

D. is basically the same as Expert

Answer: C

QUESTION NO: 45

Traps are sent to the address(es) configured in the ____ page.

A. RMON

B. SMTP

C. Options

D. SNMP
Answer: D

QUESTION NO: 46

The two Appliance models are:

A. S3000 and S4000

B. S4000 and S5000

C. S2000 and S4000

D. S4000 and S6000

Answer: D

QUESTION NO: 47

Remove file(s) from the remote agent after get is an option on the _____ screen:

A. File > Remote Open

B. File > Open

C. File > Remote Get

D. It's not an option

Answer: A
QUESTION NO: 48

With Time Synchronization which server polls the Secondary Time Server?

A. Primary Time Server

B. None of the above

C. Designated Time Server

D. Master Time Server

Answer: B

QUESTION NO: 49

True or false? A Capture filter cannot be used as a Display filter.

A. False

B. True

Answer: A

QUESTION NO: 50

With Webconsole you can access an agent directly by entering:

A. HTTP://agent name/[IP Address]

B. HTTP://[IP Address]/isniffer

C. HTTP://isniffer/[IP Address]

D. None of the above

Answer: B

QUESTION NO: 51

When a capture is saved, by default it is given the extension:

A. .CPT

B. .CAP

C. .SNF

D. .CAZ

Answer: B

QUESTION NO: 52

Sniffer Distributed Alarm Manager accepts alarms generated by:

A. Monitor

B. Triggers

C. SMTP or scripts

D. Monitor and Expert

Answer: D

QUESTION NO: 53

The Expert _______ layer relates to the OSI Network layer information

A. Station

B. Application

C. Session

D. Connection

Answer: A

QUESTION NO: 54

What are the three methods to connect to agents through SniffView?

A. Connect, Quick Connect, Connect to Selected Agent

B. Connect, Connect to Session, Quick Connect

C. Connect, Connect as New User, Quick Connect

D. Connect, Connect as Different User, Quick Connect

Answer: D
QUESTION NO: 55

With Webconsole the ____ serves as the HTTP server.

A. Sniffer Distributed Console

B. nPO Manager

C. Sniffer Distributed Agent

D. Sniffer Distributed SniffView

Answer: C

QUESTION NO: 56

With Webconsole the ____ serves as the HTTP server.

A. Sniffer Distributed Console

B. Sniffer Distributed Agent

C. nPO Manager

D. Sniffer Distributed SniffView

Answer: B

QUESTION NO: 57

True or false? Sniffer Distributed Appliances are shipped with the Verify User Info option turned on.
A. True

B. False

Answer: B

QUESTION NO: 58

The WAN600 (WANE) adapter provides_____ RS/V ports.

A. 8

B. 6

C. 4

D. 2

Answer: C

QUESTION NO: 59

The Expert _______ layer relates to the OSI Transport layer information .

A. Application

B. Session

C. Station

D. Connection
Answer: D

QUESTION NO: 60

By default, Sniffer Distributed supports a maximum of ____logged on users per Agent.

A. 8

B. 10

C. 12

D. 4

Answer: B

QUESTION NO: 61

Sniffer Distributed Console software is made up of which components?

A. ProbView, SniffView, Trap Capture, Console Display

B. ProbView, Trap Capture, Alarm Manager, GroupWare

C. SniffView, Trap Capture, Alarm Manager, GroupWare

D. SniffView, Trap Capture, Alarm Manager, Console Display

Answer: D
QUESTION NO: 62

When a capture is saved, by default it is written to the:

A. First agent that was created

B. There is no default, you must tell it where to write it

C. Agent hard drive

D. Console hard drive

Answer: C

QUESTION NO: 63

True or false? When SniffView connects to an agent, the console screen shows the familiar ProbView
interface.

A. True

B. False

Answer: B

QUESTION NO: 64

Agent name;IP address is the folder name template for:

A. Nothing, that convention is not used

B. The last console or agent default folder used

C. Console default folder

D. Agent default folder

Answer: C

QUESTION NO: 65

File > Open shows the ________ default folder.

A. SniffProbe

B. SniffView

C. Console

D. Agent

Answer: C

QUESTION NO: 66

Once you are connected to an agent as a user with all rights, what can you do?

A. Monitor the segment

B. Capture data

C. Perform Expert captures

D. All of the above

Answer: D

QUESTION NO: 67

For what purpose would you: Set the enable trap option, enter the IP address of the device to receive
traps, and enter the community name for each destination?

A. To enable collection of statistics, and to configure where RMON data will be sent

B. To configure RMON statistics that the agent will gather for a 3rd party application

C. To set the maximum number of host entries to the number of nodes you plan to monitor

D. To configure SNMP traps that the agent will send to 3rd party RMON consoles

Answer: D

QUESTION NO: 68

What does the ProbViewer Status tab show?

A. Information about Packet Generator and filtered capture activities between Agent and Console

B. Information about Host, Matrix and Protocol Distribution activities between Agent and Console

C. Information about Dashboard and History Sample activities between Agent and Console

D. A list of monitor adapters, their activity and Login Hosts

Answer: D
QUESTION NO: 69

A Diagnoses indicates that:?

A. an object has been exceeded

B. a threshold has been exceeded

C. A and B

D. there is a serious network problem

Answer: C

QUESTION NO: 70

If I want to define the severity of alarms with associated sound or action, I would choose:

A. Tools > Options > Expert > Alarms

B. Tools > Expert Options > Alarms

C. Tools > Expert > Alarms

D. Tools > Options > Alarm

Answer: D

QUESTION NO: 71

To load a file from the agent select File >:

A. Open Default

B. Remote Open

C. Open Remote

D. Open > Remote Agent

Answer: B

QUESTION NO: 72

Controlling agents and launching Alarm Manager and Remote Update are functions of:

A. ProbView

B. SniffView

C. Trap Capture

D. Sniffer Distributed Manager

Answer: B

QUESTION NO: 73

An alarm is sent to the _____ via the transport adapter when the Console software and Trap Capture
are running on the Console.

A. none of the above

B. console
C. agent

D. monitor

Answer: B

QUESTION NO: 74

True or false? The protocols for the Protocol Distribution statistics include the Network, Transport, and
Application layers.

A. False

B. True

Answer: B

QUESTION NO: 75

If the IP address of the New User configuration is left empty, the user can:

A. Log into this agent from any remote console

B. Take control of a session

C. Easily be assigned administrator rights

D. Reset all users?statistics

Answer: A
QUESTION NO: 76

Which of the following is true about transport adapters?

A. Attach to and sniff the network segment(s)

B. Communicate with the console to control the agent

C. A and B

D. Send data to third party RMON applications

Answer: C

QUESTION NO: 77

What does ProbViewer's Status window show?

A. Adapters and current logged users

B. Normal and abnormal events

C. Packet capture, Expert analysis, and decodes

D. Activity between the agent and consoles

Answer: A

QUESTION NO: 78

If you want to connect to an agent automatically with the user name and password you configured
when you added the agent to the Agent List, what do you use?
A. Connect

B. Quick Connect

C. Auto Connect

D. Connect as Different User

Answer: A

QUESTION NO: 79

True or false? Transport adapters can be Ethernet or Token Ring only.

A. True

B. False

Answer: A

QUESTION NO: 80

Below is an image of the SniffView toolbar.

Which icon represents the Modify Agent/Group function?

A. F

B. D

C. G

D. E

Answer: D

QUESTION NO: 81

A Symptom indicates that:

A. A and B

B. a threshold has been exceeded

C. an object has been exceeded

D. there is a serious network problem

Answer: B

QUESTION NO: 82

The default port where the SNMP traps are sent to is:

A. 160
B. 163

C. 162

D. 161

Answer: C

QUESTION NO: 83

If you want to connect to an agent that is not defined in the Agent List, what do you use?

A. Auto Connect

B. Connect

C. Connect as Different User

D. Quick Connect

Answer: D

QUESTION NO: 84

In SNMP/RMON mode, what does the Sniffer Distributed Agent do?

A. Captures and records statistics when no agents are logged in

B. Performs packet capture, Expert analysis, and decodes

C. Performs standard RMON1 and RMON 2 monitoring

D. Captures and records statistics when no consoles are logged in

Answer: C

QUESTION NO: 85

In a protocol conversation the following indicates a node is initiating a TCP session.

A. TCP D=1342 S=110 FIN SEQ=42795241 LEN=0 WIN=58944

B. None of the above

C. TCP D=1342 S=110 SYN ACK=95674139 SEQ=42795241 LEN=0 WIN=0

D. TCP D=1342 S=110 SYN SEQ=42795241 ACK=95674139 LEN=0 WIN=58944

Answer: B

QUESTION NO: 86

What does Remote Desktop 32 enable you to do?

A. All of the above

B. Take remote control of the agent from any computer on the network

C. Take remote control of the agent through a dial-in connection

D. Configure the agent from a remote workstation

Answer: A
QUESTION NO: 87

The console password can be a maximum of ____ alphanumeric characters.

A. 4 - 7

B. 15

C. 12

D. 8

Answer: B

QUESTION NO: 88

Multiple passive users can share the display of up to ____ sessions:

A. 2

B. 4

C. 6

D. 1

Answer: B

QUESTION NO: 89

Webconsole is only supported on ________ agents

A. Ethernet and Token Ring

B. Ethernet and HSSI

C. Ethernet and Gigabit

D. Ethernet and ATM

Answer: C

QUESTION NO: 90

What type of filter would you define to capture or display packets between network nodes?

A. Packet type filter

B. Address filter

C. Protocol filter

D. Error type filter

Answer: B

QUESTION NO: 91

True or false? Sniffer Distributed Appliances are shipped with the Verify User Info option turned on.

A. False

B. True
Answer: A

QUESTION NO: 92

Why does the Sniffer Distributed Agent need adapters?

A. To sniff the network

B. A and C

C. To create new agents

D. To communicate with the console

Answer: B

QUESTION NO: 93

Below is an image of the SniffView toolbar.

Which icon represents the Connect To Agent As Different User function?

A. D

B. C

C. B
D. A

Answer: C

QUESTION NO: 94

What is a possible cause for an ACK TOO LONG symptom ?

A. All of the above

B. The path changed in a way that increased the time between the request and its acknowledgement

C. There were multiple paths between the two stations, and the time to acknowledgement was longer
for some paths than for others

D. The recipient of the original data frame was temporarily busy, and could not process the frame as
quickly as usual

Answer: A

QUESTION NO: 95

What can watch for network problems and automatically capture traffic?

A. Display Filters

B. Alarms

C. Alarm Manager

D. Triggers
Answer: D

QUESTION NO: 96

Which adapter communicates with the console via IP/UDP and IP/TCP?

A. Monitor

B. Transport

C. WANE

D. LM2000

Answer: B

QUESTION NO: 97

If you have a keyboard and mouse attached, you can configure the Agent locally using which of the
following?

A. ProbViewer

B. SnifferProb

C. SnifViewer

D. Chat Pane

Answer: A
QUESTION NO: 98

The default directory created on the agent is based on the ____ ?

A. console adapter

B. Distributed software version

C. There is no default directory created on the agent

D. agent adapter

Answer: D

QUESTION NO: 99

The Trap Destinations (IP/Port) must be set to:

A. the SNMP management application

B. the Console port

C. 162

D. 161

Answer: A

QUESTION NO: 100

Troubleshooting Methodology will often tell us to:

A. Go back to capturing traffic if the problem is not solved

B. Define the problem and then narrow the scope

C. Troubleshoot Diagnoses first

D. Troubleshoot from the Application layer

Answer: B

QUESTION NO: 101

If you do not have a monitor, keyboard and mouse on your agent(s), you can set the IP address using
which of the following entities?

A. Monitor Agent

B. LM2000

C. LT2 Virtual Adapter

D. Remote Desktop 32

Answer: D

QUESTION NO: 102

True or false? Nothing is saved by default to the console folder.

A. True

B. False
Answer: A

QUESTION NO: 103

What does TCP D=1342 S=110 SYN SEQ=42795241 LEN=0 WIN=58944 indicate in a protocol
conversation?

A. The sending node is ending a TCP session

B. None of the above

C. The sending node should never indicate LEN=0

D. The sending node is initiating a TCP session

Answer: D

QUESTION NO: 104

There are ____ versions of Gigabit Ethernet cards.

A. 3

B. 6

C. 4

D. 2

Answer: A
QUESTION NO: 105

What does ProbViewer's Log window show?

A. Normal and abnormal events

B. Activity between the agent and consoles

C. Adapters and current logged users

D. Packet capture, Expert analysis, and decodes

Answer: A

QUESTION NO: 106

Which of the following Sniffer Distributed Agents is supported with pods?

A. Gigabit Ethernet

B. FDDI

C. ATM and Full Duplex

D. HSSI and ATM

Answer: C

QUESTION NO: 107

Below is an image of the SniffView toolbar.

Which icon represents the Quick Connect function?

A. C

B. A

C. D

D. B

Answer: A

QUESTION NO: 108

To terminate a current user and take control, a user must have which privilege?

A. Control Reset

B. Control Session

C. Remote Control

D. Reset Session

Answer: B

QUESTION NO: 109

The agent can be configured to automatically start these activities when it initializes:

A. Collect Trigger statistics

B. Collect real-time statistics

C. Collect node conversation statistics

D. A and B

Answer: D

QUESTION NO: 110

To configure SNMP traps that the agent will send to 3rd party RMON consoles, what must you do?

A. Enter the community name for each destination

B. Set the enable trap option

C. All of the above

D. Enter the IP address of the device to receive the traps

Answer: C

QUESTION NO: 111

Which adapter should have TCP/IP bound to it with an IP address for the subnet where it is installed?

A. WANE
B. Transport

C. LM2000

D. Monitor

Answer: B

QUESTION NO: 112

True or false? A Display filter cannot be used as a Capture filter.

A. True

B. False

Answer: A

QUESTION NO: 113

If a recipient memory allocation process is not providing enough buffer memory then the following
symptom will be flagged:

A. ACK Too Long

B. Too Many Retransmissions

C. Window Frozen

D. Local Routing

Answer: C
QUESTION NO: 114

If a recipient memory allocation process is not providing enough buffer memory then the following
symptom will be flagged:

A. Local Routing

B. Window Frozen

C. ACK Too Long

D. Too Many Retransmissions

Answer: B

QUESTION NO: 115

Controlling and viewing agents is the job of which of the following components?

A. Sniffer Monitor

B. Sniffer Distributed Agent

C. Sniffer Distributed Console

D. Sniffer Portable Network Analyzer

Answer: C

QUESTION NO: 116

During capture you can open the Capture Panel to observe:

A. Dashboard data only

B. Packets %

C. Gauge or Detail data

D. Detail data only

Answer: C

QUESTION NO: 117

Which ProbViewer tab shows information about Alarm activities between Agent and Console?

A. Status

B. Packet

C. Host

D. Statistics

Answer: D

QUESTION NO: 118

True or false? Full Duplex Ethernet and ATMbook are the only agents supported with pods.

A. True
B. False

Answer: A

QUESTION NO: 119

What do ProbViewer's Statistics windows show?

A. Activity between the agent and consoles

B. Normal and abnormal events

C. Adapters and current logged users

D. Packet capture, Expert analysis, and decodes

Answer: A

QUESTION NO: 120

The Agent can be configured remotely using which of the following?

A. ProbViewer or RD32

B. SnifferProb or RD32

C. None of the above

D. SniffView or RD32

Answer: D
QUESTION NO: 121

Given permissions, which user in a session can capture, generate packets, manage the database and
reset real time statistics?

A. Both active and passive users

B. The administration user

C. The active user

D. The passive user

Answer: C

QUESTION NO: 122

When you filter on a Diagnoses for the first time using the Expert Display filter:

A. That filtered window does not show Expert flagging on the errors

B. That filtered window only looks at the receiving node

C. That filtered window does show Expert flagging on the errors

D. That filtered window only looks at the sending node

Answer: A

QUESTION NO: 123

What does the Reset Stats privilege allow the user to do?

A. Reset the size of frames in the capture window

B. Reset the Appliance real-time statistics in Monitor applications

C. None of the above

D. Reset capture packets

Answer: B

QUESTION NO: 124

Traps are standard ____ traps sent to ____ applications

A. NAI/3rd party

B. SMTP/RMON II

C. SNMP/RMON

D. RMON/SNMP

Answer: C

QUESTION NO: 125

The Distributed Appliance communicates with the console using ____.

A. IP/TCP
B. NFS

C. IP/UDP

D. DNS

Answer: C

QUESTION NO: 126

Sniffer Distributed Agents need at least ___ adapter(s).

A. One

B. Four

C. Three

D. Two

Answer: D

QUESTION NO: 127

If the Expert calculates a Maximum Ack time of 178ms and a frame indicates an Ack time of 203ms there
will be an:

A. Retransmission Symptom

B. ACK Too Long Diagnoses

C. Retransmission Diagnoses

D. ACK Too Long Symptom

Answer: D

QUESTION NO: 128

Sniffer Distributed supports only ____ trap community.

A. IP address

B. public

C. A and C

D. private

Answer: B

QUESTION NO: 129

When you attempt to connect and there is currently an active connection to the agent, you are
prompted to either disconnect the active connection and become the active user or connect as a passive
user:

A. If you have Active Connection privileges

B. If you are using Quick Connect

C. If you have Control Session privileges

D. Regardless whether you have Control Session privileges

Answer: C
QUESTION NO: 130

When configuring a Monitor adapter, disable all protocols except:

A. WINS

B. Sniffer Driver

C. TCP/IP

D. IPX

Answer: B

QUESTION NO: 131

Which ProbViewer tab shows information about Dashboard and History Sample activities between
Agent and Console?

A. Statistics

B. Host

C. Packet

D. Status

Answer: A

QUESTION NO: 132

With Sniffer Distributed, which of the following monitor adapters are supported?

A. 4-port Ethernet

B. All of the above

C. 10/100 Ethernet

D. Token Ring

Answer: B

QUESTION NO: 133

With Webconsole you can access an agent directly by entering:

A. HTTP://isniffer/[IP Address]

B. HTTP://[IP Address]/isniffer

C. None of the above

D. HTTP://agent name/[IP Address]

Answer: B

QUESTION NO: 134

Traps are sent via ____ protocol to all defined SNMP communities.

A. UDP/SNMP
B. DLC layer

C. Session layer

D. TCP/SNMP

Answer: A

QUESTION NO: 135

Which ProbViewer tab shows a list of monitor adapters, their activity, and Login Hosts?

A. Status

B. Host

C. Stat

D. Packet

Answer: A

QUESTION NO: 136

True or false? Each time you connect to another agent, a new, independent SniffView session starts in a
new window.

A. True

B. False

Answer: A
QUESTION NO: 137

True or false? The WAN600 adapter provides 6 RS/V ports.

A. False

B. True

Answer: A

QUESTION NO: 138

Which Config Agent option enables nPO Visualizer to discover, monitor and collect data from its
distributed Appliances?

A. External Security

B. Enhanced Verification

C. nPO Authentication

D. HTTP Server

Answer: D

QUESTION NO: 139

If you want to override the default user name and password defined for an agent in the Agent List, what
do you use?
A. Connect as Different User

B. Connect as a new, active Agent

C. Connect

D. Quick Connect

Answer: A

QUESTION NO: 140

What does Sniffer Distributed Console software do?

A. Sets general operating preferences for the Console and Alarm Manager

B. Establishes connections to Distributed Appliances

C. Connects to agents and controls their activities

D. All of the above

Answer: D

QUESTION NO: 141

From where is Switch Expert accessed?

A. A and B

B. Sniffer Distributed Expert

C. Sniffer Distributed RMON

D. Sniffer Distributed RMON+

Answer: B

QUESTION NO: 142

In a protocol conversation the following example is sent from a client?

A. ARP C PA=[128.1.0.1] HA=WstDigE58C11 PRO=IP

B. None of the above

C. ARP C PA=[128.1.0.1] PRO=IP

D. ARP R PA=[128.1.0.1] HA=WstDigE58C11 PRO=IP

Answer: A

QUESTION NO: 143

If I want to filter on a specific field in the Detail Decode window I would create a ____ filter.

A. Address Filter

B. Data Pattern

C. Packet Filter

D. Protocol Filter
Answer: B

QUESTION NO: 144

Given permissions, what can the passive user in a session do?

A. None of the above

B. Capture, generate packets, manage the database and reset real time statistics

C. Capture and generate packets

D. Capture, generate packets and manage the database

Answer: A

QUESTION NO: 145

Which of the following are components of the Sniffer Enterprise Management Architecture?

A. Sniffer Distributed Agents and Sniffer Monitors

B. Sniffer Distributed Agents and Switch Monitors

C. Sniffer Distributed Consoles and Sniffer Monitors

D. Sniffer Distributed Agents and Sniffer Distributed Consoles

Answer: D
QUESTION NO: 146

To enable Webconsole, ____ must be installed.

A. PWS

B. Config Console

C. HTTP port 81

D. SniffProb

Answer: A

QUESTION NO: 147

When segment Monitor or Expert thresholds are exceeded, or Expert analysis detects a diagnosis, what
is sent to the console?

A. Trigger

B. Alarm

C. Capture

D. Trap

Answer: B

QUESTION NO: 148

What is a possible cause for Too Many Retransmissions Diagnoses?

A. The node is using expired or canceled routes

B. A protocol other than RIP is being used to circulate routing information.

C. The ACKs were being transmitted via a slower path

D. The analyzer has not been configured correctly to know it own subnet address

Answer: C

QUESTION NO: 149

What does the SniffView application do?

A. Launches Alarm Manager and Remote Update

B. All of the above

C. Adds, modifies and deletes users and groups

D. Connects to agents and controls them

Answer: B

QUESTION NO: 150

Which Config Agent Option enables authentication with nPO?

A. HTTP Server

B. Enhanced Verification

C. External Security
D. nPO Authentication

Answer: C