Module 12. Performance and Recovery

Event Viewer

A GUI application that allows users to easily view and sort events recorded in the event log on a computer running a Windows-based operating system.

full backup

A backup in which all data on all servers is copied to a storage medium, regardless of whether the data is new, changed, or unchanged.

surge protector

A power management device that redirects excess voltage away from connected computing or networking devices to the ground, thereby protecting connected devices from harm.

Which log type is used to prove who did what and when?

Audit log

Which type of disaster recovery site contains all the equipment you would need to get up and running again after a disaster, and yet would require several weeks to implement?

Cold site

What field in an IPv4 packet is altered to prioritize video streaming traffic over web surfing traffic?

DiffServ

Which power backup method will continually provide power to a server if the power goes out during a thunderstorm?

Online UPS

What are the two main categories of UPSs?

Online and standby (or offline)

What command requests the next record in an SNMP log?

SNMP Get Next

Which data link layer flow control method offers the most efficient frame transmission when sending large volumes of data?

Selective repeat sliding window

What are the primary data link layer flow control methods?

Stop-and-wait method, go-back-n sliding window method, and selective repeat sliding window method

Business Continuity

The ability of a company to continue doing business with the least amount of interruption possible after a major outage or other disaster.

Network Management

The assessment, monitoring, and maintenance of all aspects of a network.

Your roommate has been hogging the bandwidth on your router lately. What feature should you configure on the router to limit the amount of bandwidth his computer can utilize at any one time?

Traffic shaping

loss-tolerant

Transmissions that can tolerate occasional loss of data without compromising the user experience.

delay-sensitive

Transmissions that will suffer significantly compromised user experiences if portions of the transmission are delayed, such as with voice and video transmissions.

Which power device prevents a critical server from losing power, even for an instant?

UPS's (uninterruptible power supply)

Which of the following would an environmental monitoring system not track?

User authentication

Which backup site includes a running server that does not have access to the latest backups?

Warm site

Which of the following statements is true? Choose two.

When streaming a movie, the transmission is sensitive to delays and tolerant of loss. and When sending an email, the transmission is sensitive to loss and tolerant of delays.

Which QoS technique operates at layer 2 to more efficiently route Ethernet traffic between VLANs?

CoS (Class of Service)

NetFlow

A proprietary traffic monitoring protocol from Cisco that tracks all IP traffic crossing any interface where NetFlow is enabled.

severity level

An indication of priority that syslog assigns to each logged event. Also called logging level.

When repairing a coworker's computer, you find some illegal files. What should you do next?

Disconnect the computer from the network and leave it running.

chain of custody

Documentation that describes evidence, including when it was collected, who collected it, its condition, and how it was secured and transferred from one responsible party to the next.

Packet Analysis

The examination of information contained within packets to identify protocols, errors, and misconfigurations.

DiffServ (Differentiated Services)

A technique for ensuring QoS by prioritizing traffic.

system log

The location where syslog data is stored in the OS.

incremental backup

A backup in which only data that has changed since the last full or incremental backup is copied to a storage medium.

Cloud Site

A highly scalable, inexpensive DR (disaster recovery) option of establishing a cloud configuration that could take over many or most business processes in the event of a disaster. Also called DRaaS (disaster recovery as a service).

DRaaS (Disaster recovery as a service)

A highly scalable, inexpensive DR option of establishing a cloud configuration that could take over many or most business processes in the event of a disaster. Also called a cloud site.

alert

A message generated when a pre-defined event occurs, which is then logged by the system.

RPO (Recovery Point Objective)

A metric that defines how much data loss is tolerable, depending on what backup methods and schedules are in place.

RTO - Recovery Time Objective

A metric that defines the maximum tolerable outage time for an application or network service.

Disaster Recovery Plan (DRP)

A part of the BCP (business continuity plan) that details the processes for restoring critical functionality and data to a network after an outage.

audit trail

A system of documentation that makes it possible for a third party to inspect evidence and understand the flow of events.

logging level

An indication of priority that syslog assigns to each logged event. Also called severity level.

traffic log

Historical records of network traffic primarily used to investigate network performance issues.

Why might you want to install two power supplies in a critical server?

If one power supply fails, the other can take over.

differential backup

A backup method in which only data that has changed since the last full or incremental backup is copied to a storage medium even if earlier differential backups have been made.

flow control

A bandwidth management technique configured on interfaces to balance permitted traffic volume with a device's capability of handling that traffic.

3-2-1-1 Rule

A collection of backup principles that requires at least three complete copies of the data, backups saved on at least two media types, with at least one copy stored offsite, and at least one copy stored offline.

audit log

A collection of data in logs that is consistent and thorough enough to retroactively prove compliance and also to defensibly prove user actions.

Bandwidth Management

A collection of strategies to optimize the volume of traffic a network can support.

iPerf

A command-line based tool that can measure throughput between two network hosts.

backup

A copy of data or program files created for archiving or safekeeping.

NetFlow Analyzer

A device that collates flow records from throughout the network to provide insights into traffic patterns. Also called a NetFlow collector.

What's the difference between an incident and a disaster?

A disaster is an extreme type of incident.

audit report

A document generated after an IT audit that evaluates a business's operations, processes, infrastructure, and policies as related to its business goals and relevant laws or other standards.

Incident Response Plan

A document specifically defining the characteristics of an event that qualifies as a formal incident and the steps that should be followed as a result.

BCP (Business Continuity Plan)

A document that details how an organization intends to maintain business operations during a disaster.

buffering

A form of traffic shaping that delays less-important traffic during times of high bandwidth utilization.

first responder

A person with training or certifications in handling evidence in such a way as to preserve its admissibility in court.

cold site

A place where the computers, devices, and connectivity necessary to rebuild a network exist but are not appropriately configured, updated, or connected to match the network's current state.

hot site

A place where the computers, devices, and connectivity necessary to rebuild a network exist, and all are appropriately configured, updated, and connected to match a network's current state.

warm site

A place where the computers, devices, and connectivity necessary to rebuild a network exist, though only some are appropriately configured, updated, or connected to match the network's current state.

PDU (power distribution unit)

A power management device that acts as a sophisticated power strip to bring power from outlets, a generator, or a UPS (uninterruptible power supply) closer to the devices on a rack.

log

A record of activities or state changes on a device or in an operating system.

traffic policing

A traffic-shaping technique in which the volume or rate of traffic traversing an interface is limited to a predefined maximum.

trap

A type of unsolicited SNMP (Simple Network Message Protocol) message sent from an agent to the NMS (network management system) once specified conditions on the managed device are met.

disaster

An extreme type of incident, involving a network outage that affects more than a single system or limited group of users.

incident

Any event, large or small, that has adverse effects on a network's availability or resources.

CoS (Class of Service)

Quality control techniques performed at layer 2 on Ethernet frames.

Which congestion control techniques help to prevent network congestion?

Retransmission policy, window policy, acknowledgment policy, discarding policy, and admission policy

One of your coworkers downloaded several, very large video files for a special project she's working on for a new client. When you run your network monitor later this afternoon, what list will your coworker's computer likely show up on?

Top listeners

Which log type would most likely be used first to investigate the cause of high numbers of dropped packets?

Traffic log

What's the difference between a PDU and a UPS?

A PDU distributes power while a UPS stores power and serves as a backup power source.

OID (Object Identifier)

A number assigned each object managed by an NMS (network management system).

Baseline

A record of how a network or resource operates under normal conditions.

NMS (network management system) server

A server or workstation that collects data from multiple managed devices at regular intervals.

What is the primary challenge in properly configuring NetFlow?

A significant challenge with NetFlow is determining the optimal balance between tracking all traffic and tracking enough traffic to sufficiently observe network behavior.

When you arrive at work one morning, your inbox is full of messages complaining of a network slowdown. You collect a capture from your network monitor. What documentation can help you determine what has changed?

A baseline

UPS (uninterruptible power supply)

A battery operated power source directly attached to one or more devices and to a power supply (such as a wall outlet) that provides a backup power source in the event of a power outage and prevents undesired fluctuations of the wall outlet's AC power from harming the device or interrupting its services.

Traffic Analysis

The examination of network traffic for patterns and exceptions to those patterns.

DSCP (Differentiated Services Code Point)

The first 6 bits of the 8-bit DiffServ field in an IPv4 packet, which indicates to network routers how the data stream should be forwarded.

Which of the following would be assigned an OID?

A switch's interface

MIB (Management Information Base)

The list of objects managed by an NMS (network management system), as well as the descriptions of these objects.

Congestion Control

A bandwidth management technique used to adjust the way network devices respond to indications of network performance issues caused by traffic congestion, with the goal of ensuring devices don't make the problem worse.

Which bandwidth management technique limits traffic specifically between a single sender and a single receiver?

Flow control

Which flow control method resends a lost frame along with all frames sent with it?

Go-back-n sliding window

traffic shaping

Manipulating certain characteristics of packets, data streams, or connections to manage the type and amount of traffic traversing a network or interface at any moment. Also called packet shaping.

Which of the following is not defined by syslog?

Message Security

What port do SNMP agents listen on?

Port 161

Which backup type, if performed daily, would offer the lowest RTO and why?

While unreasonable in reality, a full backup created every day would offer the lowest RTO because it contains all backed up data together in one place

While troubleshooting a recurring problem on your network, you want to examine the TCP messages being exchanged between a server and a client. Which tool should you use on the server?

Wireshark