Question 1

Wireshark or any other monitoring software running on a single computer connected to a switch doesn't see all the traffic on a network, but only the traffic the switch sends to it, which includes broadcast traffic and traffic specifically addressed to the computer.

Accepted Answer

A) True 
 B)False  True

Question 2

In response to an incident, how should chain of custody of evidence be handled?

Accepted Answer

All collected data must be carefully processed and tracked so it does not leave official hands at any point in the forensics process. Typically, documentation used to track chain of custody describes exactly what the evidence is, when it was collected, who collected it, its condition, and how it was secured. If at any point in the process you have custody of evidence, be sure to sign off on a chain of custody document, and obtain a signature from the next person in line when you hand over custody of the evidence.

Question 3

You are attempting to determine how available your Linux systems are, and need to find the current system uptime. What command should you use?

Accepted Answer

A)   uptime
B)   show runtime
C)   lastboot
D)   display stats A

Question 4

If you wish to maintain a "4 nines" availability rating, what is the maximum amount of down time you can have per day?

Accepted Answer

A)   .4 seconds
B)   8 seconds
C)   1 minute, 26 seconds
D)   14 minutes, 23 seconds

Question 5

The Link Aggregation Control Protocol was initially defined by what IEEE standard?

Accepted Answer

A)   IEEE 802.3af
B)   IEEE 802.1cd
C)   IEEE 802.3ad
D)   IEEE 802.3bd

Question 6

A differential backup covers what data on a system?

Accepted Answer

A)   It includes all data every time it is performed.
B)   It includes only data that has changed since the last backup.
C)   It includes data that has changed since the last full backup.
D)   It includes data that has changed since the last incremental backup.

Question 7

Packets that are smaller than a medium's minimum packet size are known by what term below?

Accepted Answer

A)   jabbers
B)   giants
C)   ghosts
D)   runts

Question 8

What makes up the first 6 bits of the 8-bit DiffServ field?

Accepted Answer

A)   Priority Code Point (PCP) 
B)   Differentiated Services Code Point (DSCP) 
C)   Class of Service (CoS) 
D)   Forward Error Correction (FE
C)

Question 9

What is distributed switching?

Accepted Answer

A)   It is when multiple physical switches are configured to act as a single switch.
B)   It is multiple switches that provide redundancy switching for all switches in the group.
C)   It is a single physical switch that is partitioned in software to perform as multiple switches.
D)   It is a single distributed vSwitch that can service VMs across multiple hosts.

Question 10

The SNMP version 3 protocol introduces authentication, validation, and encryption for messages exchanged between devices and the network management console.

Accepted Answer

A) True 
 B)False

Question 11

What happens when an NMS uses the SNMP walk command?

Accepted Answer

A)   The NMS sends a request for data to the agent on a managed device.
B)   The NMS uses get requests to move through sequential rows in the MIB database.
C)   The NMS requests a list of all active SNMP traps on the system.
D)   The NMS walks through a list of given SNMP hosts.

Question 12

Once a device has failed, what metric measures the average amount of time to repair?

Accepted Answer

A)   mean time to repair (MTTR) 
B)   mean time to restore (MTTR) 
C)   mean field replacement time (MFRT) 
D)   mean restoration time (MRT)

Question 13

Most UNIX and Linux desktop operating systems provide a GUI application for easily viewing and filtering the information in system logs.

Accepted Answer

A) True 
 B)False

Question 14

The Link Aggregation Control Protocol (LACP) can be configured in what three different ways?

Accepted Answer

The answer of The Link Aggregation Control Protocol (LACP) can...

Question 15

In preparing and planning for disaster recovery, what is the difference between an incident and a disaster?

Accepted Answer

The answer of In preparing and planning for disaster recovery,...

Question 16

The creation of a response team should include what team roles?

Accepted Answer

The answer of The creation of a response team should...

Question 17

Sections of a disaster recovery plan related to computer systems should include what information?

Accepted Answer

The answer of Sections of a disaster recovery plan related...

Question 18

What statement regarding the use of a network attached storage device is accurate?

Accepted Answer

A)   A NAS does not contain its own file system, rather it relies on the host file system provided by individual clients.
B)   A NAS reads and writes from its disks significantly slower than other types of servers.
C)   A NAS can be easily expanded without interrupting service.
D)   A NAS can typically only support RAID-0 configurations.

Question 19

When viewing a syslog message, what does a level of 0 indicate?

Accepted Answer

A)   The message is an error condition on the system.
B)   The message is a warning condition on the system.
C)   The message is an emergency situation on the system.
D)   The message represents debug information.

Question 20

How does a line conditioning UPS protect network equipment?

Accepted Answer

A)   It protects against electrical surges.
B)   It shields equipment from lightning damage.
C)   It reduces fluctuations in incoming voltage.
D)   It filters line noise from incoming power.

Exam 11: Network Performance and Recovery