Hybrid-Cloud-Observability-Network-Monitoring Hybrid Cloud Observability Network Monitoring Exam Questions and Answers

Comprehensive and Detailed Explanation From Exact Extract:

If logs are not being sent from a Windows agent, you must confirm that the log forwarding feature is enabled. Even if the agent is installed, logs will not be transmitted unless this setting is turned on.

The documentation notes:

"Ensure the agent is configured to forward logs. Log forwarding must be enabled for the agent to transmit log data to the SolarWinds platform."

Comprehensive and Detailed Explanation From Exact Extract:

For organizations with very large environments and strict requirements for data freshness and availability, SolarWinds documentation prescribes several specific steps:

A. Deploy multiple additional polling engines (APEs) in each regional datacenter and configure load balancing."For environments exceeding 20,000 monitored interfaces, deploy multiple Additional Polling Engines (APEs) to distribute load and maintain polling intervals. Place APEs close to monitored devices to reduce latency."

B. Implement SolarWinds High Availability (HA) pools for both the main and polling engine servers, with active-passive failover."SolarWinds HA pools provide automatic failover for platform and polling engines, ensuring service continuity in case of hardware or network failures."

C. Configure the SolarWinds database server in a Microsoft SQL Server Always On Availability Group."To protect against database outages, deploy the SolarWinds database in a SQL Server Always On Availability Group or Failover Cluster Instance (FCI)."

Option D is incorrect; overlapping node groups are not a requirement and, in fact, the documentation suggests using dynamic assignment to balance load, not strictly static node groups.

Comprehensive and Detailed Explanation From Exact Extract:

SolarWinds provides several statistics for network capacity planning, most notably:

Memory usage data on nodes: Useful for forecasting resource exhaustion on network devices.

Receive utilization on interfaces: Essential for predicting bandwidth saturation and planning upgrades.

The documentation states:

"Key statistics for network capacity planning include interface utilization trends (receive and transmit) and memory utilization, which allow for forecasting and proactive infrastructure management."

Comprehensive and Detailed Explanation From Exact Extract:

A. Communication issue exists in new device: If there is an SNMP or network issue, the poller cannot retrieve data.

D. Object IDs (OIDs) are not supported: The new device may not support the same OIDs as the test device, resulting in no data returned.

SolarWinds documentation notes:

"When extending a poller to other devices, ensure network/SNMP communication is successful and that the target devices support the required OIDs. Differences in support or access may cause data collection to fail on some nodes."

Comprehensive and Detailed Explanation From Exact Extract:

ICMP polling in SolarWinds only provides basic status (up/down) by sending ping requests to the device. For more detailed statistics such as interface traffic, CPU load, and memory usage, SNMP polling must be enabled. The documentation states:

"ICMP polling provides only basic reachability and response time. To collect detailed statistics such as device health, performance, and interface details, SNMP polling must be configured on the device and enabled in SolarWinds."

Comprehensive and Detailed Explanation From Exact Extract:

When a node status is “unknown,” it often means the SolarWinds platform cannot communicate with the node. The first checks should be:

Ping response: Verify if the node is reachable via ICMP ping, as lack of response leads to an unknown status.

Polling method: Confirm the correct polling method (ICMP, SNMP, WMI, API) is configured and functioning.

OID (A) is related to SNMP but not directly to basic node status, and view method (D) is not a relevant diagnostic step.

Comprehensive and Detailed Explanation From Exact Extract:

Enabling DNS resolution but not storing hostnames immediately results in:

Reduced database memory/storage used for DNS info, as hostnames aren’t stored with each flow record.

Less database space used for flows, since flow records will reference IPs rather than resolved DNS names.

Reduced SQL server reads/writes since the platform does not immediately resolve and store hostnames with every received flow, decreasing load.

DNS names will still appear in reports where resolved dynamically, so option C is incorrect.

Comprehensive and Detailed Explanation From Exact Extract:

If devices respond to SNMP queries individually but aren't discovered during network scans, the most likely cause is the discovery timeout value being set too low. This can result in slower devices timing out before responding to discovery requests, even though they are operational and SNMP-enabled.

The documentation explains:

"If devices are not discovered but respond to SNMP queries, increase the discovery timeout and retry. Short timeouts can cause missed responses from devices that take longer to reply during scanning."

The “top talkers” feature tracks the highest-bandwidth consumers in your network. Lowering the optimization value means more flows and more detailed data are collected and stored, which can increase the storage requirement on your server.

Exact Extract from Official Guide:

“Decreasing the Top Talkers optimization value results in the storage of more detailed data, which increases the database and storage requirements.”

— (Network Performance Monitor Administrator Guide, “NetFlow and Top Talkers Optimization” section)

Comprehensive and Detailed Explanation From Exact Extract:

A. MIB files define the available SNMP objects and metrics that can be polled from a device.

C. MIB files provide human-readable names and descriptions for OIDs, allowing SolarWinds to display metrics in a clear, user-friendly format instead of raw OID numbers.

Automatic device discovery is handled by network scanning, not by MIB files, and OIDs are created by device vendors, not by SolarWinds.

Comprehensive and Detailed Explanation From Exact Extract:

Custom pollers are typically created when you need to monitor metrics or OIDs that are not supported by default in SolarWinds:

Monitor specific metric that is not out-of-the-box: If a device exposes a metric not natively monitored by SolarWinds, you must create a custom poller for that metric.

Monitor unsupported object ID: For any OID that is not included in default templates, a custom poller is necessary.

Monitoring special equipment or devices without WMI might also need custom pollers, but the requirement specifically applies when you need to access non-standard metrics or OIDs.

Comprehensive and Detailed Explanation From Exact Extract:

A. Ensuring that firewall rules allow SNMP traffic is essential, especially when monitoring remote site nodes.

C. Basic connectivity should be checked by pinging the node from the SolarWinds application server.

D. If the SNMP community string is changed, the SNMP service on the device must be restarted for the new configuration to take effect.

Option B is not required unless SNMPv3 is specifically being used, and even then, SNMPv2c and SNMPv1 are still widely supported and commonly used.

Comprehensive and Detailed Explanation From Exact Extract:

The most common cause of duplicate flow data in SolarWinds NTA is when source network devices are configured to export both ingress and egress flow data on the same interfaces. This results in the same traffic being reported twice, leading to inflated statistics and duplicate entries.

Comprehensive and Detailed Explanation From Exact Extract:

Show best is the status rollup mode designed for groups of redundant or backup devices. It displays the "best" (most available/least severe) status within the group, which is most useful when any one device in the group being up means the group is healthy.

Comprehensive and Detailed Explanation From Exact Extract:

SolarWinds Hybrid Cloud Observability supports multiple flow protocols for monitoring network traffic. The correct supported sources are:

J-Flow: This is the flow protocol used by Juniper devices.

NetStream: This is the flow protocol used by Huawei devices.

“Cisco” is not a flow protocol (Cisco devices use NetFlow), and “cFlow” is not a supported protocol.

Exact Extract from Official Guide:

"Hybrid Cloud Observability supports NetFlow (Cisco), J-Flow (Juniper), NetStream (Huawei), sFlow, and IPFIX for comprehensive traffic analysis."

— (Network Performance Monitor Administrator Guide, “Supported Flow Sources” section)

Comprehensive and Detailed Explanation From Exact Extract:

For secure syslog (Syslog over TLS), the standard port used is TCP 6514. SolarWinds Log Analyzer and Platform listen on TCP port 6514 for secure syslog messages.

Exact Extract from Official Guide:

"Log Analyzer supports receiving secure syslog messages over TCP port 6514, in accordance with the RFC 5425 standard."

— (Log Analyzer Administrator Guide, “Syslog Configuration” section)

Comprehensive and Detailed Explanation From Exact Extract:

SolarWinds' log processing policies for svslog (syslog) and traps (SNMP traps) are processed independently and concurrently. This is because syslog and SNMP trap processing are separate services with their own processing pipelines, unlike the global pre and post policies which affect overall log routing or rule order.

Comprehensive and Detailed Explanation From Exact Extract:

According to the latest SolarWinds Administrator Guides, integrating Cisco ACI for true Hybrid Cloud Observability involves several coordinated steps:

B. Configure API polling credentials for the APIC cluster under “Settings > All Settings > Manage ACI” in SolarWinds.SolarWinds Hybrid Cloud Observability leverages API-based polling (not only SNMP) to retrieve comprehensive fabric topology, health scores, faults, and logical object inventory (tenants, application profiles, EPGs, etc.). Configuration of API credentials is required to access these features."For deep ACI monitoring, use API credentials under 'Manage ACI'. SNMP alone is insufficient for advanced monitoring, object mapping, or health correlation."

C. Enable NetFlow export from all ACI leaf switches to the SolarWinds collector and import flow definitions in the Platform.NetFlow is essential for capturing east-west and north-south traffic inside the fabric, and SolarWinds uses this flow data for bandwidth analysis and path visualization."SolarWinds recommends enabling NetFlow export on all leafs and importing flow records to gain traffic visibility inside Cisco ACI environments."

D. Map tenants, application profiles, and endpoint groups (EPGs) to custom properties for advanced alerting and reporting.Custom properties in SolarWinds allow mapping logical ACI constructs to alert rules, reports, and dashboards for business-centric monitoring."Map EPGs and application profiles to custom properties for granular alerting and business-aligned dashboards."

Option A is incorrect because the official guide states that API polling (not just SNMP v3 with plugins) is required for automatic APIC object discovery.

Comprehensive and Detailed Explanation From Exact Extract:

To monitor and configure High Availability (HA) mode for site-to-site VPN tunnels on a Cisco ASA firewall, SolarWinds uses SNMP for standard device and interface metrics, and CLI polling for advanced VPN and HA state details. SNMP provides general health data, while CLI polling (using Device Studio or Network Insight) collects information not available via SNMP, such as detailed VPN and HA status.

Comprehensive and Detailed Explanation From Exact Extract:

B. NetFlow data is commonly used to diagnose network performance issues, such as identifying sources of congestion or bottlenecks.

C. NetFlow analysis provides visibility into which applications and endpoints are consuming bandwidth and causing congestion.

User authorization and link status events are not functions of NetFlow; those are handled by other monitoring tools or features.

Comprehensive and Detailed Explanation From Exact Extract:

List resources is the menu where you can select or deselect which interfaces (including operationally down and administratively shutdown ones) are monitored for a node. This allows you to uncheck unnecessary or down interfaces and prevent them from impacting the node status.

The “Device View” feature allows users to view the physical layout of device interfaces on graphical stencils, providing an intuitive graphical representation of port locations and status.

Exact Extract from Official Guide:

“Device View displays the physical layout of device interfaces using graphical stencils for supported devices.”

— (Network Performance Monitor Administrator Guide, “Device View” section)

Comprehensive and Detailed Explanation From Exact Extract:

When a device returns multi-core CPU statistics as a table, SolarWinds Device Studio allows you to use the "Add Calculated Value" option and select the average function. This enables the web console widget to display the computed average CPU utilization automatically.

The documentation explains:

"For devices with multi-core CPUs, you can use the Add Calculated Value feature in the Device Studio to compute the average (or other statistical functions) of returned table values, which can then be visualized directly in widgets."

Universal Device Pollers (UDPs) are tied to the polling engine on which they are created. This means if a UDP is created on the main polling engine, it will only collect data for devices polled by that engine. To collect data from devices polled by an additional polling engine, you must create or assign the UDP on that engine as well.

Exact Extract from Official Guide:

“Universal Device Pollers are tied to the polling engine on which they are created. To monitor devices assigned to an Additional Polling Engine, the UDP must be created or assigned on that engine.”

— (Network Performance Monitor Administrator Guide, “Universal Device Pollers” section)

Comprehensive and Detailed Explanation From Exact Extract:

If a node remains in “unknown” status:

A. Ping device from assigned polling engine: Verifies direct network connectivity from the poller to the node.

C. Verify the appropriate polling method is set for this node: Ensures SolarWinds uses the correct protocol (ICMP, SNMP, WMI, etc.) for monitoring.

D. Verify a ping response for this node is received through the ICMP: Confirms basic reachability and that the node is not blocking ping requests.

Running an SNMP walk (B) can help diagnose SNMP-specific issues but is not always directly relevant to a node simply being in “unknown” status unless SNMP is the configured polling method.

Comprehensive and Detailed Explanation From Exact Extract:

SolarWinds provides the flow alert wizard as the tool to configure and manage flow alerts. This wizard guides administrators through selecting the relevant flow metrics and alert thresholds.

The documentation states:

"Use the Flow Alert Wizard to define and manage alerts on flow-based data, allowing for rapid detection and notification of anomalous network activity."

Comprehensive and Detailed Explanation From Exact Extract:

Unknown flow traffic often occurs when SolarWinds receives flow data from sources not defined in its database, or when flow-enabled devices are not sending data to the expected port.

Add the devices and interfaces to SolarWinds' database: Ensures flow data is properly associated with monitored objects, resolving the "unknown" status.

Ensure flow-enabled devices send data to the appropriate port: If data is sent to the wrong port, SolarWinds cannot process it correctly, leading to unknown events.

SolarWinds documentation notes:

"Unknown flow traffic typically indicates a mismatch between flow sources and known device/interface configurations, or incorrect UDP port configuration. Registering devices/interfaces and verifying port assignments resolves most unknown flow issues."

Comprehensive and Detailed Explanation From Exact Extract:

The Flow Navigator in SolarWinds NetFlow Traffic Analyzer (NTA) is a powerful custom filter and analysis tool. It enables users to apply multiple filters to NetFlow data, allowing the visualization of specific statistics about the entire network or selected subsets, such as all traffic from a certain IP range or application. This approach eliminates the need to manually click through device-by-device views, instead providing comprehensive traffic analysis across the whole monitored environment through a single, customizable interface.

Comprehensive and Detailed Explanation From Exact Extract:

A. A different port is being used: If MSSQL traffic is sent on a port different from the default (1433), SolarWinds may not classify it as MSSQL unless custom mapping is defined.

C. The source or the destination port field is not present: Application mapping relies on port information; missing fields prevent classification.

The documentation states:

"Unclassified traffic may result when known applications use non-default ports or when flow records lack required port information for mapping."

Comprehensive and Detailed Explanation From Exact Extract:

Capacity forecasting accuracy is directly impacted by:

Amount of historical data used: More historical data provides better trend analysis.

Exhaustion calculation method: Different methods (e.g., linear, peak, moving average) affect how forecasts are calculated.

Polling interval: More frequent polling increases granularity and the accuracy of forecasting.

Warning thresholds (D) do not affect the precision of forecasts, only the alerting behavior.

Comprehensive and Detailed Explanation From Exact Extract:

To display the serial number in the node details widget using Device Studio, you must add a new data source field, name it "Serial Number," and provide the correct OID that polls the serial number from the device. This field then appears in the node details widget for the custom poller. Editing an existing field's name is not best practice, and UDPs cannot be linked directly to Device Studio widgets.

Comprehensive and Detailed Explanation From Exact Extract:

Duplicate flows can occur if multiple interfaces export the same data or if NetFlow is configured on both ingress and egress interfaces. SolarWinds documentation recommends:

Enabling the “flow de-duplication” feature within NetFlow Traffic Analyzer to automatically filter duplicate data.

Ensuring NetFlow is enabled only on ingress interfaces (best practice), as enabling it on both directions can result in duplicate records.

Automatic addition of flow sources and enabling on sub-interfaces do not directly address duplication.

Comprehensive and Detailed Explanation From Exact Extract:

You can check the status of the flow collector service from the NetFlow collector services section and from NetFlow settings in the SolarWinds web console. These locations provide service health, up/down status, and logs. "Flow and CBQoS sources" and "Top XX receivers" do not display service health.

Comprehensive and Detailed Explanation From Exact Extract:

Duplicate flow data typically results when both ingress and egress flow monitoring are applied simultaneously on interfaces. If both directions are enabled either globally (all interfaces) or locally (on a single interface), the same flow is counted twice—once entering and once leaving—resulting in duplicate statistics.

Comprehensive and Detailed Explanation From Exact Extract:

Universal Device Pollers (UDPs) must be explicitly assigned to each node for which custom polling is required. Adding a new node does not automatically assign existing UDPs to that node, even if it’s the same device type as others already using the poller. Assigning the existing UDP to the new node will resolve the issue and enable polling of the desired data.

If flows are confirmed as reaching the poller but no data appears in the web console, the most common cause is a missing or incorrect source address field in the flow configuration on the sending device. SolarWinds uses the source address to match incoming flows to the correct device record in its database; if this field is missing or misconfigured, the data will not be processed or displayed.

Exact Extract from Official Guide:

“If the source address field is missing or incorrectly configured in the flow-exporting device, the system cannot associate the flow with a monitored device, and no data will appear in the console.”

— (Network Performance Monitor Administrator Guide, “Troubleshooting NetFlow” section)

Comprehensive and Detailed Explanation From Exact Extract:

NetFlow is the Cisco IOS feature designed for monitoring and analyzing network traffic to pinpoint specific applications or endpoints consuming bandwidth or causing network slowness. It captures detailed flow information, including source/destination, ports, and protocols.

Comprehensive and Detailed Explanation From Exact Extract:

To add additional NetFlow collector ports, you must stop the NetFlow service and then specify multiple ports separated by commas in the NetFlow collector services widget.

From the documentation:

"To configure multiple collector ports, stop the NetFlow service, edit the collector ports in the widget by separating them with commas, and then restart the service."

Comprehensive and Detailed Explanation From Exact Extract:

If interfaces on a node show an “unknown” status, the recommended solution is to delete and rediscover the node. This ensures all current interface information, OIDs, and properties are correctly detected and polled, resolving mismatch or missing data that can cause an “unknown” status.

Comprehensive and Detailed Explanation From Exact Extract:

SolarWinds identifies and classifies flow traffic based on application and port mapping in the platform.

"Unclassified traffic in flow charts often occurs when an application is not mapped in the system, or when the application uses a port that is not defined in the SolarWinds Hybrid Cloud Observability (HCO) application mapping database. Flows from unsupported devices or flow direction do not cause unclassified application traffic—rather, they will not be collected or will be marked as unknown flows."

Thus, unclassified traffic can result from new or custom applications or changes in port usage that are not reflected in the configuration.

Comprehensive and Detailed Explanation From Exact Extract:

According to the SolarWinds documentation:

"The maximum number of resources that can be displayed in any flow chart or view is 50. Attempting to display more may impact performance and will not be rendered in the UI."

This ensures optimal performance and usability of the charts within the platform.

Comprehensive and Detailed Explanation From Exact Extract:

SolarWinds Log Analyzer supports secure syslog forwarding using the TCP protocol. The industry standard and the default port used for secure syslog (Syslog over TLS/TCP) is port 6514. This is referenced in SolarWinds documentation where it specifies:

"For secure syslog forwarding, Log Analyzer uses TCP port 6514, which is the default for syslog over TLS, as defined by RFC 5425."

This ensures that log data is encrypted during transmission, enhancing security over the default UDP port 514 (which is used for non-secure syslog).