201-01 sample questions

Question 1

A company has deployed a SteelCentral NetShark appliance to perform continuous packet capture in their data center. To conserve storage space, the network team wants to capture only the traffic related to their critical database servers, which reside in the 10.50.10.0/24 subnet. They also want to exclude all SSH (TCP port 22) management traffic from the capture. Which of the following NetShark capture job configurations would achieve this?

Accepted Answer

Filter: `net 10.50.10.0/24 and not port 22`

Answer

Filter: `host 10.50.10.0/24 exclude port 22`

Answer

Filter: `subnet 10.50.10.0 mask 255.255.255.0 except tcp.port == 22`

Answer

Filter: `ip.addr == 10.50.10.0/24 && !(tcp.port == 22)`

Question 2

A large e-commerce company, 'ShopFast,' is preparing for its annual holiday sales event. Their primary customer-facing application is a multi-tier web service hosted in a hybrid cloud environment. In previous years, they experienced slowdowns where customers reported pages taking over 10 seconds to load, but the infrastructure team could not pinpoint the cause, blaming either the network, database, or web servers. This year, they have deployed SteelCentral AppResponse to gain deeper insight.

The key business requirement is to proactively identify which specific web pages and underlying database queries are contributing to poor user experience. The IT director wants a single metric that represents the end-user's perception of performance for every transaction. They also need the ability to drill down from a slow user session directly to the associated network and server metrics to facilitate rapid root cause analysis between the network, server, and application teams.

The current setup includes AppResponse monitoring traffic from a SPAN port in front of the web server farm. The network team has confirmed that all client-to-server and server-to-database traffic is visible to the appliance. The goal is to isolate the 'blame' for slowdowns to either network latency, server processing time, or specific application components.

Which AppResponse capability is most critical for ShopFast to configure and monitor to meet the IT director's requirement for a single, user-centric performance metric and enable blame-domain isolation?

Accepted Answer

Defining Web Business Transactions and tracking the End-User Experience (EUE) time.

Answer

Configuring Application-Specific Modules (ASMs) for their custom application code.

Answer

Monitoring Network Delay and Server Delay metrics for all TCP conversations.

Answer

Creating custom Interactive Reports based on URI stems and SQL query hashes.

Question 3

True or False: The primary function of the SteelCentral Flow Gateway is to perform deep packet inspection (DPI) and generate application-level performance metrics.

Accepted Answer

False

Answer

True

Question 4

A network administrator is configuring Host Groups in SteelCentral NetProfiler to better organize and report on traffic from different company departments. What are two key benefits of using Host Groups? (Select TWO)

Accepted Answer

They allow for the creation of reports that show traffic totals for an entire department instead of individual IPs.

Accepted Answer

They simplify the process of defining services and policies by using logical group names instead of long lists of IP addresses.

Answer

They enable per-host-group security policies to block malicious traffic.

Answer

They automatically apply QoS policies to the underlying network infrastructure based on group membership.

Answer

They provide a mechanism for real-time packet capture for all hosts within a group.

Question 5

An engineer is analyzing a performance issue in a three-tier application using data from a NetShark appliance. The analysis shows significant delays. The engineer suspects the issue is between the Application Server and the Database Server. The following diagram represents the TCP round-trip time (RTT) measurements from the NetShark's perspective. Given the data presented, where is the most likely source of the application delay?
```mermaid
sequenceDiagram
participant Client
participant AppServer as Application Server
participant DBServer as Database Server

Client->>AppServer: HTTP Request
Note right of Client: Network RTT (Client-App): 20ms
AppServer->>DBServer: SQL Query
Note right of AppServer: Server Processing: 50ms
Note right of AppServer: Network RTT (App-DB): 150ms
DBServer-->>AppServer: SQL Result
Note left of DBServer: DB Processing: 30ms
AppServer-->>Client: HTTP Response
```

Accepted Answer

The network between the Application Server and the Database Server.

Answer

The network between the Client and the Application Server.

Answer

The processing time on the Application Server.

Answer

The query processing time on the Database Server.

Question 6

A network operations team uses SteelCentral Portal to display a consolidated view of network and application performance. The team lead wants to create a custom dashboard that shows the top 10 applications by bandwidth from NetProfiler alongside the top 5 web applications by user experience time from AppResponse. Which Portal feature should be used to accomplish this?

Accepted Answer

Adding and configuring pre-defined NetProfiler and AppResponse widgets to a new dashboard view.

Answer

Configuring data source credentials for NetProfiler and AppResponse.

Answer

Creating a new custom report with data from both sources.

Answer

Using the Portal's REST API to manually pull and display the data.

Question 7

When using SteelCentral Transaction Analyzer to troubleshoot a multi-tier application, what is the primary purpose of creating a 'Transaction' model?

Accepted Answer

To map the sequence of messages across different application tiers and visualize the end-to-end response time.

Answer

To capture live network packets for the application.

Answer

To generate synthetic traffic to load-test the application.

Answer

To configure alerting thresholds for application performance.

Question 8

A company is deploying SteelCentral NetProfiler Enterprise, which consists of a separate database, application, and web server. What is the primary reason for this distributed architecture compared to the all-in-one NetProfiler appliance?

Accepted Answer

To enable scalability for high flow rates and long-term data retention in large environments.

Answer

To provide high availability through active-active clustering.

Answer

To meet security compliance requirements by isolating system functions.

Answer

To reduce the software licensing cost by using commodity hardware.

Question 9

An engineer using SteelCentral Packet Analyzer opens a large trace file and wants to quickly identify all conversations that experienced TCP retransmissions. Which feature would be the most efficient way to achieve this?

Accepted Answer

Accessing the TCP 'Expert Events' view to see a summary of all retransmission events.

Answer

Manually applying a display filter for `tcp.analysis.retransmission`.

Answer

Using the 'Follow TCP Stream' feature on each conversation individually.

Answer

Sorting the packet list by the 'Time' column to look for large gaps.

Question 10

A hospital is using NetProfiler to monitor its network. The security team is concerned about potential data exfiltration and has asked the network team to create an alert that triggers if any single host inside the network transfers more than 1 GB of data to an external public IP address over a 1-hour period. Which combination of NetProfiler components is required to build this alert? (Select THREE)

Accepted Answer

A Host Group defining the internal network addresses.

Accepted Answer

A Service Definition for external traffic.

Accepted Answer

A Policy that sets a threshold on the 'Total Bytes' metric for the defined Service.

Answer

An Application Definition for all TCP and UDP ports.

Answer

A custom report scheduled to run every hour.

Answer

A NetShark capture job triggered by the alert.

Free 201-01 sample questions

True or False: The primary function of the SteelCentral Flow Gateway is to perform deep packet inspection (DPI) and generate application-level performance metrics.

A network administrator is configuring Host Groups in SteelCentral NetProfiler to better organize and report on traffic from different company departments. What are two key benefits of using Host Groups? (Select TWO)

When using SteelCentral Transaction Analyzer to troubleshoot a multi-tier application, what is the primary purpose of creating a 'Transaction' model?

A company is deploying SteelCentral NetProfiler Enterprise, which consists of a separate database, application, and web server. What is the primary reason for this distributed architecture compared to the all-in-one NetProfiler appliance?

An engineer using SteelCentral Packet Analyzer opens a large trace file and wants to quickly identify all conversations that experienced TCP retransmissions. Which feature would be the most efficient way to achieve this?

10 more free samples are waiting