Hybrid-Cloud-Observability-Network-Monitoring Hybrid Cloud Observability Network Monitoring Exam Questions and Answers

Comprehensive and Detailed Explanation From Exact Extract:

When the SNMP community string is changed on a device, SolarWinds recommends:

Edit the node properties and save the changes.

Update the community string in node properties to match the new value on the device.

"To restore polling, edit the node in SolarWinds, update the SNMP community string in the properties, and save the changes. This ensures that SolarWinds can authenticate and resume polling. Deleting and re-adding the node is not necessary, nor is restarting the SNMP service on the device in most cases."

Comprehensive and Detailed Explanation From Exact Extract:

Device Studio is specifically designed to build custom pollers for missing or vendor-specific metrics that are not natively included in node details. It is best used to enrich the node details with custom OID-based metrics from devices.

From the documentation:

“Use Device Studio to build pollers for new metrics not present in the default node details, particularly for custom or third-party equipment.”

Comprehensive and Detailed Explanation From Exact Extract:

The most common cause of duplicate flow data in SolarWinds NTA is when source network devices are configured to export both ingress and egress flow data on the same interfaces. This results in the same traffic being reported twice, leading to inflated statistics and duplicate entries.

Comprehensive and Detailed Explanation From Exact Extract:

When displaying Universal Device Poller (UDP) data in different web console views, each view must be configured to show the UDP results as charts.

From the documentation:

“In the Universal Device Poller application, under the Web Display tab, you must check the ‘chart’ box for every web view where you want to display the poller data. If the box is not checked for the current view, the data will not be visible as a chart widget.”

Comprehensive and Detailed Explanation From Exact Extract:

In SolarWinds Universal Device Poller (UDP), the column get type is used to retrieve values from a particular column of an SNMP table, meaning you get all the values for that column across multiple rows.

Comprehensive and Detailed Explanation From Exact Extract:

Duplicate flows can occur if multiple interfaces export the same data or if NetFlow is configured on both ingress and egress interfaces. SolarWinds documentation recommends:

Enabling the “flow de-duplication” feature within NetFlow Traffic Analyzer to automatically filter duplicate data.

Ensuring NetFlow is enabled only on ingress interfaces (best practice), as enabling it on both directions can result in duplicate records.

Automatic addition of flow sources and enabling on sub-interfaces do not directly address duplication.

Comprehensive and Detailed Explanation From Exact Extract:

Network Insight in SolarWinds supports in-depth monitoring for certain advanced switch platforms. According to the latest SolarWinds Network Performance Monitor Administrator Guide:

"Network Insight for Cisco Nexus provides advanced visibility into the health, configuration, and performance of Nexus switches. This includes inventory, configuration changes, interface health, VDCs, and more."

Other switch families such as Brocade, Juniper, and Meraki are not currently supported by Network Insight.

Comprehensive and Detailed Explanation From Exact Extract:

To collect and analyze Windows event logs in SolarWinds Hybrid Cloud Observability, you must:

Deploy and configure the platform agent on the Windows server: The agent is responsible for collecting logs locally, including event logs, and sending them to the SolarWinds platform for analysis.

Configure the Windows server to send logs to the SolarWinds platform: This can be achieved by forwarding event logs from the Windows server to the server running the SolarWinds platform (e.g., via Windows Event Forwarding or syslog if using third-party tools).

Simply configuring rules within the platform does not automatically grant access to Windows event logs; deployment of the agent or configuration of log forwarding is required for collection. This requirement is outlined in the Log Analyzer Administrator Guide and the Hybrid Cloud Observability documentation for Windows log collection.

Comprehensive and Detailed Explanation From Exact Extract:

SolarWinds Hybrid Cloud Observability (HCO) supports capturing flow data and CBQoS data using:

A. IPFIX: (IP Flow Information Export) is the IETF standard for exporting flow information, supported for both flow data and CBQoS.

C. NetFlow: Developed by Cisco, widely used for flow and CBQoS data collection.

J-Flow is primarily for flow data (from Juniper devices), and SNMP is not a flow export protocol.

The documentation states:

"NetFlow (including NetFlow v9) and IPFIX are supported for flow and CBQoS data collection. These standards provide extensive network traffic and QoS visibility within HCO."

Comprehensive and Detailed Explanation From Exact Extract:

If logs are not being sent from a Windows agent, you must confirm that the log forwarding feature is enabled. Even if the agent is installed, logs will not be transmitted unless this setting is turned on.

The documentation notes:

"Ensure the agent is configured to forward logs. Log forwarding must be enabled for the agent to transmit log data to the SolarWinds platform."

Comprehensive and Detailed Explanation From Exact Extract:

Enabling DNS resolution but not storing hostnames immediately results in:

Reduced database memory/storage used for DNS info, as hostnames aren’t stored with each flow record.

Less database space used for flows, since flow records will reference IPs rather than resolved DNS names.

Reduced SQL server reads/writes since the platform does not immediately resolve and store hostnames with every received flow, decreasing load.

DNS names will still appear in reports where resolved dynamically, so option C is incorrect.

Comprehensive and Detailed Explanation From Exact Extract:

Applications and NBAR2 applications in top applications are sorted by bytes: The default sorting for the “Top Applications” view, including NBAR2 apps, is by bytes.

It is possible to combine applications and NBAR2 applications: SolarWinds allows combining standard and NBAR2-classified apps for alerting and reporting purposes.

Exact Extract from Official Guide:

"Top Applications, including NBAR2, are sorted by bytes and you can combine standard and NBAR2 application data in alerts and reports."

— (Network Performance Monitor Administrator Guide, “NBAR2 Applications” section)

Comprehensive and Detailed Explanation From Exact Extract:

If a device studio poller is configured with a static textual value (rather than a dynamic OID), any change in the actual value on the node will not be detected automatically; the poller’s configuration must be manually updated to reflect the new value. OID-based pollers update automatically as values change on the device.

Comprehensive and Detailed Explanation From Exact Extract:

According to the latest SolarWinds Administrator Guides, integrating Cisco ACI for true Hybrid Cloud Observability involves several coordinated steps:

B. Configure API polling credentials for the APIC cluster under “Settings > All Settings > Manage ACI” in SolarWinds.SolarWinds Hybrid Cloud Observability leverages API-based polling (not only SNMP) to retrieve comprehensive fabric topology, health scores, faults, and logical object inventory (tenants, application profiles, EPGs, etc.). Configuration of API credentials is required to access these features."For deep ACI monitoring, use API credentials under 'Manage ACI'. SNMP alone is insufficient for advanced monitoring, object mapping, or health correlation."

C. Enable NetFlow export from all ACI leaf switches to the SolarWinds collector and import flow definitions in the Platform.NetFlow is essential for capturing east-west and north-south traffic inside the fabric, and SolarWinds uses this flow data for bandwidth analysis and path visualization."SolarWinds recommends enabling NetFlow export on all leafs and importing flow records to gain traffic visibility inside Cisco ACI environments."

D. Map tenants, application profiles, and endpoint groups (EPGs) to custom properties for advanced alerting and reporting.Custom properties in SolarWinds allow mapping logical ACI constructs to alert rules, reports, and dashboards for business-centric monitoring."Map EPGs and application profiles to custom properties for granular alerting and business-aligned dashboards."

Option A is incorrect because the official guide states that API polling (not just SNMP v3 with plugins) is required for automatic APIC object discovery.

The “top talkers” feature tracks the highest-bandwidth consumers in your network. Lowering the optimization value means more flows and more detailed data are collected and stored, which can increase the storage requirement on your server.

Exact Extract from Official Guide:

“Decreasing the Top Talkers optimization value results in the storage of more detailed data, which increases the database and storage requirements.”

— (Network Performance Monitor Administrator Guide, “NetFlow and Top Talkers Optimization” section)

Comprehensive and Detailed Explanation From Exact Extract:

To combine two polled values into a single value in the web console, you need to:

Create a separate poller for each OID.

Use a transform (in the UDP tool) to add or otherwise combine the values from the two pollers into one displayed value.

Exact Extract from Official Guide:

Comprehensive and Detailed Explanation From Exact Extract:

ICMP polling in SolarWinds only provides basic status (up/down) by sending ping requests to the device. For more detailed statistics such as interface traffic, CPU load, and memory usage, SNMP polling must be enabled. The documentation states:

"ICMP polling provides only basic reachability and response time. To collect detailed statistics such as device health, performance, and interface details, SNMP polling must be configured on the device and enabled in SolarWinds."

Comprehensive and Detailed Explanation From Exact Extract:

False positives in hardware health alerts often occur when the polled MIB on the device is not the preferred or correct MIB for that particular hardware platform. This can result in SolarWinds interpreting SNMP data incorrectly, causing inaccurate alerts. Ensuring that the device is using the recommended MIB for hardware health resolves these false alert issues.

Comprehensive and Detailed Explanation From Exact Extract:

A. MIB files define the available SNMP objects and metrics that can be polled from a device.

C. MIB files provide human-readable names and descriptions for OIDs, allowing SolarWinds to display metrics in a clear, user-friendly format instead of raw OID numbers.

Automatic device discovery is handled by network scanning, not by MIB files, and OIDs are created by device vendors, not by SolarWinds.

Comprehensive and Detailed Explanation From Exact Extract:

A node rediscovery updates all node and interface information, including names, IP addresses, captions, and interface aliases. Running a rediscovery on the node ensures all related interface details are refreshed in the SolarWinds database and web console.

Comprehensive and Detailed Explanation From Exact Extract:

Custom pollers are typically created when you need to monitor metrics or OIDs that are not supported by default in SolarWinds:

Monitor specific metric that is not out-of-the-box: If a device exposes a metric not natively monitored by SolarWinds, you must create a custom poller for that metric.

Monitor unsupported object ID: For any OID that is not included in default templates, a custom poller is necessary.

Monitoring special equipment or devices without WMI might also need custom pollers, but the requirement specifically applies when you need to access non-standard metrics or OIDs.

Comprehensive and Detailed Explanation From Exact Extract:

If devices respond to SNMP queries individually but aren't discovered during network scans, the most likely cause is the discovery timeout value being set too low. This can result in slower devices timing out before responding to discovery requests, even though they are operational and SNMP-enabled.

The documentation explains:

"If devices are not discovered but respond to SNMP queries, increase the discovery timeout and retry. Short timeouts can cause missed responses from devices that take longer to reply during scanning."

Comprehensive and Detailed Explanation From Exact Extract:

The Universal Device Poller (UDP) in SolarWinds NPM allows users to monitor any SNMP-exposed value, including interface traffic, UPS battery status, and CPU temperature, provided the device's MIB exposes the relevant OIDs. Users configure the UDP to poll these custom OIDs, making it a flexible option for monitoring a wide range of metrics across diverse devices.

Comprehensive and Detailed Explanation From Exact Extract:

In SolarWinds, the OID description is determined by the MIB database. If a particular OID description is missing or incorrect, the recommended action is to update the MIB database. This can be done by requesting the latest MIB database from SolarWinds support, which regularly releases updates to support new devices and OIDs.

Comprehensive and Detailed Explanation From Exact Extract:

SolarWinds capacity forecasting accuracy improves when:

More historical data is used: The more historical data points included in calculations, the better the forecasting model will perform.

Using average daily values for calculations: This smooths out anomalies and provides a more accurate trend, as recommended in the documentation:

“To improve the precision of capacity forecasting, use as much historical data as possible and set calculations to use average daily values.”

Monitoring with platform agents or adjusting thresholds affects alerting, not trend accuracy.

Comprehensive and Detailed Explanation From Exact Extract:

Unknown flow traffic often occurs when SolarWinds receives flow data from sources not defined in its database, or when flow-enabled devices are not sending data to the expected port.

Add the devices and interfaces to SolarWinds' database: Ensures flow data is properly associated with monitored objects, resolving the "unknown" status.

Ensure flow-enabled devices send data to the appropriate port: If data is sent to the wrong port, SolarWinds cannot process it correctly, leading to unknown events.

SolarWinds documentation notes:

"Unknown flow traffic typically indicates a mismatch between flow sources and known device/interface configurations, or incorrect UDP port configuration. Registering devices/interfaces and verifying port assignments resolves most unknown flow issues."

Comprehensive and Detailed Explanation From Exact Extract:

When you create a flow alert in SolarWinds, the object of the alert (such as a specific interface, node, or application) is chosen from the “Create a Flow Alert” panel. Flow alerts are not based on custom SQL queries, require the NetFlow service to be running, and always have associated trigger actions.

Comprehensive and Detailed Explanation From Exact Extract:

The Universal Device Poller (UnDP) in SolarWinds allows you to create custom SNMP pollers. Results from UnDPs can be displayed as charts, gauges, or tables on SolarWinds web console views. The administrator guide states:

“Universal Device Pollers (UnDPs) allow you to collect SNMP data not provided natively by SolarWinds. The collected results can be displayed as charts, gauges, or tables, making it easier to visualize the custom metrics.”

Device Studio pollers are templates used to define UnDPs, but it is the UnDP that presents data visually. Hardware health and Network Insight are not custom pollers.

Comprehensive and Detailed Explanation From Exact Extract:

NetFlow is the Cisco IOS feature designed for monitoring and analyzing network traffic to pinpoint specific applications or endpoints consuming bandwidth or causing network slowness. It captures detailed flow information, including source/destination, ports, and protocols.

Comprehensive and Detailed Explanation From Exact Extract:

Only SNMP version 3 supports advanced authentication methods such as MD5, SHA1, SHA256, and SHA512 in SolarWinds and other SNMP-compliant platforms.

The documentation specifies:

"SNMP v3 provides secure authentication and encryption options, including MD5, SHA1, SHA256, and SHA512. Versions 1 and 2c only support community string authentication."

Comprehensive and Detailed Explanation From Exact Extract:

When a node status is “unknown,” it often means the SolarWinds platform cannot communicate with the node. The first checks should be:

Ping response: Verify if the node is reachable via ICMP ping, as lack of response leads to an unknown status.

Polling method: Confirm the correct polling method (ICMP, SNMP, WMI, API) is configured and functioning.

OID (A) is related to SNMP but not directly to basic node status, and view method (D) is not a relevant diagnostic step.

Comprehensive and Detailed Explanation From Exact Extract:

Hiding an IP address group in IPAM management means that group will not appear in dashboards, charts, or reports, but the underlying data and group definition remain intact and are not deleted.

Comprehensive and Detailed Explanation From Exact Extract:

To properly collect and display NetFlow data in SolarWinds NTA, the following requirements must be met:

C. Each device that exports NetFlow data to SolarWinds’ NTA must be monitored in NPM.

NTA (NetFlow Traffic Analyzer) relies on devices being monitored by NPM (Network Performance Monitor) to collect and correlate flow data.

D. The interface through which a device exports NetFlow data must be monitored in NPM.

Only interfaces that are managed in NPM can be used for NetFlow data collection, visualization, and reporting.

Devices do not need to be monitored in NCM (Network Configuration Manager) for NetFlow, and exporting NetFlow is not optional if you want the device’s flows displayed in NTA.

Comprehensive and Detailed Explanation From Exact Extract:

The flow navigator in SolarWinds NetFlow Traffic Analyzer allows users to filter and analyze flow data. For future access, you can save your custom view to the menu bar from the flow navigator, providing one-click access to your saved configurations.

The documentation states:

“To save a custom NetFlow analysis for future use, configure your view in the flow navigator, then select the option to save the view to the menu bar for easy retrieval.”

Comprehensive and Detailed Explanation From Exact Extract:

A. Communication issue exists in new device: If there is an SNMP or network issue, the poller cannot retrieve data.

D. Object IDs (OIDs) are not supported: The new device may not support the same OIDs as the test device, resulting in no data returned.

SolarWinds documentation notes:

"When extending a poller to other devices, ensure network/SNMP communication is successful and that the target devices support the required OIDs. Differences in support or access may cause data collection to fail on some nodes."

Comprehensive and Detailed Explanation From Exact Extract:

In SolarWinds Log Analyzer and other log-based alerting systems, "flood protection" is a key feature to prevent alert storms when numerous events trigger a rule in a very short period. From the SolarWinds documentation:

"Flood protection ensures that if an excessive number of log entries match a rule in a short period, only a manageable number of actions are triggered, and the remainder are suppressed or summarized. This prevents overwhelming the system and users with repeated alerts."

This is best practice for maintaining alert quality and system performance.

If flows are confirmed as reaching the poller but no data appears in the web console, the most common cause is a missing or incorrect source address field in the flow configuration on the sending device. SolarWinds uses the source address to match incoming flows to the correct device record in its database; if this field is missing or misconfigured, the data will not be processed or displayed.

Exact Extract from Official Guide:

“If the source address field is missing or incorrectly configured in the flow-exporting device, the system cannot associate the flow with a monitored device, and no data will appear in the console.”

— (Network Performance Monitor Administrator Guide, “Troubleshooting NetFlow” section)

Comprehensive and Detailed Explanation From Exact Extract:

To request an update to the SolarWinds MIB database, you must provide a complete SNMP walk or MIB walk from the device in question. This allows SolarWinds to identify and incorporate new OIDs and their definitions into the database.

From the documentation:

"Submit a request with a full SNMP walk or MIB walk output from your device. This provides the necessary OID and device structure for the SolarWinds team to update the MIB database."

Comprehensive and Detailed Explanation From Exact Extract:

B. NetFlow data is commonly used to diagnose network performance issues, such as identifying sources of congestion or bottlenecks.

C. NetFlow analysis provides visibility into which applications and endpoints are consuming bandwidth and causing congestion.

User authorization and link status events are not functions of NetFlow; those are handled by other monitoring tools or features.

Comprehensive and Detailed Explanation From Exact Extract:

Device Studio pollers offer more advanced capabilities than traditional Universal Device Pollers (UDPs). While both can poll SNMP-enabled devices, Device Studio pollers can gather additional node details (such as chassis information and advanced device metrics) that UDPs are not able to access. UDPs are limited to polling OIDs and displaying simple numeric or textual values. The official documentation states that Device Studio expands the range of supported technologies and provides access to more detailed device information compared to UDPs.

Comprehensive and Detailed Explanation From Exact Extract:

SolarWinds provides the flow alert wizard as the tool to configure and manage flow alerts. This wizard guides administrators through selecting the relevant flow metrics and alert thresholds.

The documentation states:

"Use the Flow Alert Wizard to define and manage alerts on flow-based data, allowing for rapid detection and notification of anomalous network activity."

Comprehensive and Detailed Explanation From Exact Extract:

When collecting Windows event logs without installing an agent, SolarWinds recommends converting those events to SNMP traps or syslog messages using the SolarWinds Event Log Forwarder for Windows. This allows the platform to ingest and recognize Windows events through standard logging protocols.

"The SolarWinds Event Log Forwarder for Windows enables you to forward Windows event logs as SNMP traps or syslog messages, allowing agentless collection and integration into your SolarWinds platform."

Option C, converting events to traps, is the correct method supported for agentless environments.