A.  

They all point to the same NTP server.

B.  

The Profiler, ideally, points to an NTP server (although it can use local time as well), the Gateway and Sensor get their time information from the Profiler which acts as their NTP Server.

C.  

For security reasons, all components use local time. The same time should be set on each component.

D.  

They all synchronize their time via timestamps in Netflow sources.

A.  

A service segment is the update time period when devices send Netflow to Cascade Gateways.

B.  

A service segment is defined by its components and the applications and/or ports in use between them.

C.  

A service segment is defined as the front-end tier that directly services end users with an application.

D.  

A service segment is the update time period when Cascade Sensors send MNMP Flow to Cascade Profilers.

A.  

According to the Cascade Pilot time zone.

B.  

According to the time zone of the Cascade Shark to which you are connected.

C.  

According to Cascade Pilot time zone or optionally, to the Cascade Shark time zone as well.

D.  

According to UTC.

A.  

Cascade Pilot Views Advanced Settings under the Settings menu

B.  

Port/Protocols Names and Port/Protocols Groups under the Port/Protocol Definition menu

C.  

Layer-4 Mappings and Application-Definitions under the Definitions menu

D.  

Layer-4 Mappings under the Advanced Settings menu

E.  

Defined as a BPF filter when configuring a Capture job

A.  

Set the disk space for that data resolution to 0 in Configuration > Flow Log.

B.  

Set the disk space for that data resolution to -1 in Configuration > Flow Log.

C.  

Set the disk space for that data resolution to -1 in Configuration > General Settings.

D.  

Set the disk space for that data resolution to 0 in Configuration > General Settings.

A.  

1 second on a local System, 10 milliseconds on Cascade Sharks.

B.  

1 millisecond for any View.

C.  

1 millisecond for specific Views.

D.  

Generally minimum 1 second, maximum 1 day.

A.  

SNMP v3 trap message

B.  

SNMP v2 trap message

C.  

PDF message in email

D.  

SNMP v1 trap message

E.  

HTML message in email

A.  

SNMP based technology can query a network device for statistics such as number of packets and bytes sent out an interface but typically doesn't have conversation-level details (such as which IP Addresses where talking at a given time)

B.  

NetFlow based technology can query a network device for statistics such as number of packets and bytes sent out an interface but typically doesn't have conversation-level details (such as which IP Addresses where talking at a given time)

C.  

NetFlow based technology does NOT typically include response time information, packet inspection is necessary to measure response times

D.  

It is NOT possible to understand which conversations traversed a link without full packet capture

E.  

SNMP based technology querying routers in the network can be used to view end to end conversations across a network to determine top talkers

A.  

Placed in an unassigned group.

B.  

Not placed into a group within the group type.

C.  

Not allowed

D.  

Flagged as an error.

E.  

Likely to cause errors in the future.

A.  

By listing lost packets in the expert window

B.  

By using dotted-dashed lines for out-of-sequence segments

C.  

By placing error names on the messages within the diagram

D.  

By color-coding the messages on the diagram

E.  

By using a thicker line for messages that include errors

A.  

WAN Dashboard

B.  

Application Dashboard

C.  

Devices/Interfaces View

D.  

Network Operations Dashboard

E.  

Network Security Dashboard

A.  

Active Directory information for successful/failed login association to IPs

B.  

DHCP for host IP to MAC address association.

C.  

SNMP polling to routers, switches, and servers for CPU information.

D.  

SNMP trap data from routers, switches, and servers for security events.

E.  

SNMP polling to routers and switches for MAC address and physical switch port association.

A.  

UDP flow

B.  

TCP flow

C.  

An RST after the fifth data packet

D.  

Retransmitted ACK's

E.  

Retransmitted FIN's

A.  

It obtains L2 retransmissions from switches and routers via SNMP.

B.  

It obtains TCP retransmissions by tracking TCP sessions via the Cascade Sensor.

C.  

Cascade does not track retransmissions.

D.  

Cascade obtains retransmissions from NetFlow and/or sFlow marked with the TCP push flag.

A.  

Cascade Pilot is started with administrator privileges.

B.  

Cascade Shark is configured to show capture ports.

C.  

You apply a View to the interface and create a Watch on Web traffic.

D.  

You have privileges to do so in your user profile.

A.  

Ability to identify Scanners and Worm Propagations.

B.  

Ability to provide information for a firewall rule when a user defined policy is violated.

C.  

Ability to alert on security policy (e.g. an insecure policies, such as FTP, is in use).

D.  

Ability to identify Worms by name.

A.  

Every DNS server in the AD environment

B.  

Any server in the MS domain

C.  

Every client desktop in the AD environment

D.  

Every NTP server in the MS domain

E.  

The Microsoft Event Collector component in the AD environment

A.  

50

B.  

75

C.  

100

D.  

125

E.  

Unlimited

A.  

80/tcp

B.  

8080/tcp

C.  

8090/tcp

D.  

443/tcp

E.  

22/tcp

A.  

Can be created from a single applied View.

B.  

Can work on local trace files only.

C.  

Can include more than two charts.

D.  

Is not available in the regular Cascade Pilot installation.

A.  

Packets can be captured from multiple capture ports on one Cascade Shark appliance.

B.  

The maximum length the packet data can be specified.

C.  

Packets can be filtered on host IP addresses.

D.  

SSL traffic can be decoded if the appropriate certificate are loaded in the Cascade Shark appliance.

E.  

The maximum storage bandwidth for the job can be specified in bits/sec.

F.  

Multiple packet capture jobs can run concurrently.

A.  

By setting intelligent static thresholds for Application metrics and Interface metrics, tolerance can be determined. Cascade will use these thresholds and tolerances to report on deviations indicative of performance problems.

B.  

The Customer only needs to identify their critical hosts, interfaces and/or applications, and Cascade will automatically baseline their behavior and report on deviations indicative of performance problems.

C.  

The Performance Analytics use knowledge of hosts, interfaces, and/or applications are able to detect security threats such as host scans and worms.

D.  

After baselining is completed, Cascade can re-route congested traffic to avoid congested application delivery paths.

A.  

With red text.

B.  

With yellow text.

C.  

With a funnel icon.

D.  

With a hash-mark icon.

A.  

Views should always be applied directly to the job trace.

B.  

Trace clips should first be created, and views applied to them.

C.  

Packets should be exported from the capture job trace before beginning analysis.

D.  

The capture job trace should first be indexed by right-clicking on it and selecting "Index".

A.  

Appear with a red lightning bolt icon within Cascade Pilot.

B.  

Appear with a lock icon within Cascade Pilot.

C.  

Appear with a grey lightning bolt icon within Cascade Pilot.

D.  

Appear with a yellow lightning bolt icon within Cascade Pilot.

E.  

Appear with the trace clip name in red text within Cascade Pilot.

A.  

Watched list as a bar chart

B.  

Watched list as a stacked area chart

C.  

Watched list as a line graph

D.  

Watched list as a pie chart

E.  

Top list as a bar chart

A.  

Network Round Trip measurement

B.  

Packet logging

C.  

Server Delay measurement

D.  

Connection Throughput measurement

E.  

Retransmission measurement

F.  

L7 application fingerprint checking

A.  

You can connect directly to the Cascade Shark with Cascade Pilot to begin analysis.

B.  

You can connect directly to the Cascade Shark with Cascade Gateway to begin analysis.

C.  

You can start analysis on the Cascade Profiler based upon flow data that has been sent from Cascade Shark to Cascade Profiler.

D.  

You can export data from a capture job directly to a packet capture (pcap) file and open in any tool that accepts pcap format.

E.  

You can start by loading views of the data from the Cascade Shark Appliance Web GUI before export to Wireshark.

A.  

At least one NetFlow sources (router, switch, or steelhead).

B.  

At least one lookup router and at least one access tier switch.

C.  

A Vulnerability Scanner and a Netflow source (router, switch, or steelhead).

D.  

A Vulnerability Scanner and an External Link.

A.  

One minute flow records are deleted from the file system FIFO (oldest first) once the appliance has filled the space that is allocated.

B.  

There is a fixed amount of space on the filesystem for completed reports.

C.  

A report template can be marked "keep until I delete it" so that any reports that are scheduled with this template are not automatically deleted from the filesystem.

D.  

When the flows or rollup records have been deleted from the filesystem, any saved report that was generated from those flow sources is no longer available.

E.  

Users have the ability to allocate additional space to the 1 min flow logs in order to increase retention. This is done at the expense of other rollup resolutions.

A.  

200,000 flows per minute per port

B.  

300,000 flows per minute per port

C.  

500,000 flows per minute per port

D.  

500,000 flows per minute total

E.  

600,000 flows per minute total

A.  

A Cascade Standard Profiler

B.  

An Cascade Enterprise Class Profiler (only from the Dispatcher Module)

C.  

A Cascade Shark appliance

D.  

A Cascade Gateway

E.  

A Cascade Express Profiler

A.  

Cascade Profiler local database

B.  

User account specifies authentication by RADIUS

C.  

TACACS

D.  

RADIUS server to authenticate the user

A.  

The license key is entered during installation. The license is activated either through an Internet connection or by phone.

B.  

The license key is entered during installation. The license must be activated through an Internet connection.

C.  

The license key is entered during installation. There is no activation but Cascade Pilot will detect if the license is already in use on the network.

D.  

There is no license key activation. The software image is shipped with the license key installed.

A.  

The Network Operations Dashboard

B.  

The "Interface Information" Report available from the "Reports->Shortcuts" page

C.  

The "System > Information" page

D.  

The "System > Devices/Interfaces" page

A.  

In-chart tool controls

B.  

Data Retention Time

C.  

Chart Color scheme

D.  

Application of a Filter

E.  

Sampling Time