RANGER CompTIA Network+ (N10-009) · chapter 14 of 29
Week 14: Normal, and what isn't
In this chapter Objectives 3.2
Objective 3.2
Baselines and logs
Baseline metrics
A baseline records normal performance over time: bandwidth, CPU, memory, latency, error counts, by hour and day. With a baseline you can tell a normal Monday-morning peak from a real problem, and plan capacity.
Exam tip Take baselines when things are healthy, and refresh them after big changes (new site, new app).
Anomaly alerting and notification
Once you know normal, set thresholds so the system raises an anomaly alert and notifies people (email, text, chat) when a metric goes far outside it, like the WAN link at 95% at 2 a.m.
Exam tip Thresholds too tight = alert fatigue. Too loose = missed outages. Baselines help you set them.
Log aggregation: syslog collector
Devices write logs; log aggregation gathers them in one place. A syslog collector receives syslog messages (usually UDP 514) from many devices. Each message has a severity from 0 to 7.
0 Emergency 1 Alert 2 Critical 3 Error 4 Warning 5 Notice 6 Info 7 Debug
Exam tip Lower number = worse. 'Every Awesome Cisco Engineer Will Need Ice cream Daily' = levels 0-7.
SIEM
A security information and event management (SIEM) system goes beyond collecting: it normalizes logs from firewalls, servers, switches and apps, correlates events across them, alerts on suspicious patterns, and keeps long-term records for investigations and compliance.
Exam tip Collector = stores logs. SIEM = stores, correlates and alerts across sources.
API integration
Modern gear and cloud services expose an application programming interface (API), usually REST over HTTPS with JSON. Monitoring tools use it to pull stats, push config, or open tickets automatically, often richer and faster than SNMP.
Objective 3.2
Monitoring solutions
Network discovery
Network discovery finds what is connected: devices, IPs, open services, neighbors. Run it ad hoc (on demand, like when you inherit a new site) or scheduled (nightly or weekly) to catch new and rogue devices.
Exam tip Scheduled discovery spotted a new device on the warehouse VLAN? Check it against the asset inventory.
Five things to watch
CompTIA's monitoring solutions:
- Traffic analysis: what protocols and hosts use the bandwidth (flows, captures)
- Performance monitoring: latency, throughput, utilization, errors vs. baseline
- Availability monitoring: is it up? (ping, SNMP, uptime %) to prove SLAs
- Configuration monitoring: alerts when a config changes or drifts from golden
- Network discovery: what is out there right now
Check yourself 1A syslog collector receives messages at severity 2 and severity 6 from the core switch. Which is more urgent?
- Severity 6, because it is an Error-level event
- Severity 6, because higher is worse
- Severity 2, because lower is worse
- They are equal; severity is just a label
Show the answer
Answer: C. Severity 2, because lower is worse
Syslog severity runs from 0 (Emergency) to 7 (Debug). Level 2 is Critical; level 6 is Informational.
Practice questions
Answer in your head, then open the answer. Ranger's Packet Trail has 483 questions like these for Network+, with mock exams.
Question 1A developer says an app sends malformed HTTP headers to a server. The network team must see the exact bytes on the wire. Which method should they use?
- NetFlow records
- SNMP traps
- Baseline metrics
- Packet capture
Show the answer
Answer: D. Packet capture
Only a packet capture records full packet contents, including headers, so it can be decoded in a protocol analyzer such as Wireshark.
Question 2A security team needs a copy of all traffic entering and leaving switch port Gi1/0/24 sent to an IDS on port Gi1/0/48. What should be configured on the switch?
- An SNMP trap on Gi1/0/24
- A trunk link between Gi1/0/24 and Gi1/0/48
- Port mirroring (SPAN) to Gi1/0/48
- Port security on Gi1/0/48
Show the answer
Answer: C. Port mirroring (SPAN) to Gi1/0/48
Port mirroring (Cisco calls it SPAN) copies traffic from source ports or VLANs to a destination port where a sensor or analyzer listens.
Question 3WAN utilization alerts fire every Monday at 9 a.m., but that is when everyone logs in and syncs mail. How can the team reduce false alerts while still catching real problems?
- Build baseline metrics and alert on deviations from normal
- Raise every alert threshold to 100%
- Replace SNMP polling with packet capture
- Turn off monitoring during business hours
Show the answer
Answer: A. Build baseline metrics and alert on deviations from normal
A baseline captures normal behavior over time, so anomaly alerting can flag only real deviations, such as heavy traffic at 3 a.m.
Question 4Forty switches, three firewalls and two wireless controllers each keep their event messages locally, and investigations take hours. Which solution BEST helps?
- Increase the local log buffer on each device
- Forward all logs to a syslog collector or SIEM
- Install a network tap on every uplink port
- Enable SNMP read-write on all devices
Show the answer
Answer: B. Forward all logs to a syslog collector or SIEM
Log aggregation sends logs to one place (a syslog server or SIEM) where they can be searched, correlated and kept longer.
Question 5A switch sends the message in the exhibit to the syslog server. What is its severity level?
- 5 (Notice)
- 2 (Critical)
- 4 (Warning)
- 3 (Error)
Show the answer
Answer: D. 3 (Error)
The number after the facility in a Cisco message is the severity: %LINK-3-UPDOWN is level 3, Error. Syslog levels run 0 Emergency, 1 Alert, 2 Critical, 3 Error, 4 Warning, 5 Notice, 6 Informational, 7 Debugging.
CompTIA, A+, Network+, Security+ and Linux+ are trademarks of CompTIA, Inc. Ranger Gamez is not affiliated with or endorsed by CompTIA. The practice questions are written to the published exam objectives; they are not real exam questions.