CSLB General Building (B) — All Questions

Which protocol allows network devices to be monitored and managed by collecting metrics such as interface counters and CPU usage?

• a.NTP
• b.SNMP✓
• c.TFTP
• d.SMTP

SNMP (Simple Network Management Protocol) polls and collects metrics like interface statistics and CPU usage from managed devices. SNMPv3 adds authentication and encryption over earlier versions. It is a foundational tool for network monitoring systems.

An organization wants a centralized record of events from all network devices for correlation and alerting. Which system aggregates these logs?

• a.DHCP server
• b.DNS resolver
• c.RADIUS server
• d.Syslog server✓

A syslog server centralizes log messages from many devices, enabling correlation, retention, and alerting. Consistent timestamps from NTP make correlation reliable. SIEM platforms often ingest syslog data for security analysis.

Why is accurate time synchronization across network devices important for operations?

• a.It ensures log timestamps align for accurate event correlation✓
• b.It increases available interface bandwidth
• c.It eliminates the need for routing protocols
• d.It replaces the need for DNS resolution

Accurate time via NTP ensures that log entries from different devices share a consistent timeline, which is critical for correlating events during troubleshooting or security investigations. Without synchronized clocks, reconstructing an incident becomes difficult. NTP typically uses UDP port 123.

Which metric describes the variation in packet delay that can degrade real-time voice and video quality?

• a.Throughput
• b.Bandwidth
• c.Jitter✓
• d.Attenuation

Jitter is the variation in delay between received packets and is especially harmful to real-time applications like VoIP and video. Buffers can absorb small amounts of jitter, but excessive jitter causes choppy audio. QoS policies help minimize it.

An administrator wants to prioritize voice traffic over bulk file transfers on a congested link. Which mechanism should be configured?

• a.Port mirroring
• b.Quality of Service (QoS)✓
• c.Spanning tree
• d.Jumbo frames

Quality of Service (QoS) classifies and prioritizes traffic so latency-sensitive flows like voice receive preferential treatment during congestion. Marking and queuing ensure critical traffic is served first. Without QoS, all traffic competes equally.

Which document records the physical and logical layout of network cabling, ports, and connections for reference during maintenance?

• a.Acceptable use policy
• b.Incident response plan
• c.Service level agreement
• d.Network topology diagram✓

A network topology diagram documents devices, cabling, and connections, serving as a reference during maintenance and troubleshooting. Keeping it current speeds fault isolation. Physical and logical diagrams may be maintained separately.

What is the primary purpose of establishing a performance baseline for a network?

• a.To define normal behavior so anomalies can be detected✓
• b.To permanently cap the maximum throughput of links
• c.To replace the need for monitoring tools
• d.To assign static IP addresses to servers

A baseline captures normal metrics such as utilization, latency, and error rates so that deviations signaling problems can be identified. Comparing current data against the baseline speeds anomaly detection. Baselines should be updated as the network evolves.

Which agreement defines the guaranteed uptime and response times a service provider commits to deliver?

• a.MOU
• b.NDA
• c.SLA✓
• d.AUP

A Service Level Agreement (SLA) specifies measurable commitments such as guaranteed uptime and response times between a provider and customer. Failing to meet an SLA may trigger penalties or credits. SLAs guide operational priorities and escalation.

An operations team uses a port on a switch to capture all traffic passing through other ports for analysis. What is this feature called?

• a.Link aggregation
• b.Port mirroring (SPAN)✓
• c.Port security
• d.Trunking

Port mirroring, also called SPAN, copies traffic from one or more ports to a monitoring port where a packet analyzer or IDS can inspect it. This provides visibility without inline placement. It is a common tool for troubleshooting and security monitoring.

Which change management step should occur before implementing a major network change?

• a.Immediately push the change during peak hours
• b.Skip documentation to save time
• c.Disable all monitoring during the change
• d.Obtain approval and prepare a rollback plan✓

Sound change management requires securing approval and preparing a rollback plan so the change can be reversed if problems arise. Documentation and scheduling during maintenance windows reduce risk. Skipping these steps increases the chance of prolonged outages.

Which type of backup site is fully equipped and running, allowing near-immediate failover during a disaster?

• a.Hot site✓
• b.Cold site
• c.Warm site
• d.Mirror archive

A hot site is fully operational with hardware, data, and connectivity ready for near-immediate failover, minimizing downtime. Cold sites provide only space and power, and warm sites fall in between. Hot sites cost the most to maintain.

In monitoring terminology, what does SNMP use to send an unsolicited alert from a device to the management station?

• a.Poll
• b.Walk
• c.Trap✓
• d.Get

An SNMP trap is an unsolicited notification a device sends to the management station when an event occurs, such as an interface going down. This is more efficient than waiting for the next poll. Traps enable near-real-time alerting.

Which metric expresses the actual rate of successful data delivery over a link, as opposed to its rated capacity?

• a.Bandwidth
• b.Throughput✓
• c.Latency
• d.Frequency

Throughput is the measured rate of successful data delivery, which is often lower than the link's rated bandwidth due to overhead, congestion, or errors. Bandwidth is the theoretical maximum capacity. Comparing the two reveals efficiency losses.

Which document should users acknowledge to define appropriate use of network resources and prohibited activities?

• a.Acceptable Use Policy✓
• b.Bill of materials
• c.Wiring schematic
• d.Change request form

An Acceptable Use Policy (AUP) defines what users may and may not do with organizational network resources. It sets expectations and provides a basis for enforcement. Users typically sign it during onboarding.

A network is configured so that DHCP requests from a remote subnet are forwarded to a central DHCP server. Which feature enables this?

• a.DNS forwarding
• b.Proxy ARP
• c.Port forwarding
• d.DHCP relay (IP helper)✓

A DHCP relay, configured with an IP helper address, forwards broadcast DHCP requests from a client subnet to a DHCP server on another subnet. This allows one central server to serve many subnets. Without it, DHCP broadcasts would not cross the router.

Which recovery metric defines the maximum acceptable amount of data loss measured in time?

• a.MTBF
• b.MTTR
• c.RPO✓
• d.RTO

The Recovery Point Objective (RPO) defines how much data, measured in time, an organization can afford to lose, guiding backup frequency. RTO addresses how quickly systems must be restored. Together they shape disaster recovery planning.

An administrator wants to standardize device configurations and deploy them at scale automatically. Which approach best supports this?

• a.Manually typing commands on each device
• b.Configuration management and automation tools✓
• c.Disabling all remote management
• d.Relying only on factory defaults

Configuration management and automation tools apply standardized, version-controlled configurations across many devices consistently and quickly. This reduces human error and configuration drift. Automation is increasingly central to modern network operations.

Which protocol synchronizes clocks across network devices to a reliable time source?

• a.NTP✓
• b.SNMP
• c.LDAP
• d.SMTP

Network Time Protocol (NTP) synchronizes device clocks to authoritative time sources, keeping logs and certificates consistent. It uses a stratum hierarchy to indicate proximity to the reference clock. Accurate time underpins logging and security functions.

Which cloud connectivity model provides a dedicated private circuit between an organization and its cloud provider instead of traversing the public internet?

• a.A site-to-site VPN over the internet
• b.A remote-access SSL VPN
• c.A public API gateway
• d.A direct/private cloud interconnect✓

A direct or private cloud interconnect provides a dedicated circuit between the organization and the cloud provider, offering predictable performance and better security than the public internet. It avoids exposure to internet congestion and threats. Providers market these as direct-connect or express-route style services.