A financial services company is experiencing intermittent latency with their online trading platform during peak hours. The network team uses SteelCentral NetProfiler to monitor traffic. They've noticed that while overall bandwidth utilization is acceptable, certain TCP connections show high 'Server Delay'. To investigate further, they need to isolate traffic specifically for the trading application, which uses a proprietary protocol on TCP port 3307. Which NetProfiler feature is most effective for creating a dedicated, long-term view of this specific application's performance metrics?
Answer and explanation
Correct answer: B
Defining a new Application in NetProfiler is the best approach for long-term, dedicated monitoring. This allows NetProfiler to baseline the traffic, generate specific performance metrics (like network vs. server delay), and trigger alerts for this application as a distinct entity. While custom reports and ad-hoc filters are useful for temporary analysis, an Application Definition provides persistent, structured monitoring.
Question 2
A network engineer is using SteelCentral Packet Analyzer to diagnose a slow file transfer issue between a client and a server. The packet trace shows multiple TCP segments with the 'TCP Window Full' message from the receiver (server). Concurrently, the sender (client) exhibits several 'TCP Zero Window' probes. What is the most likely root cause of this performance problem based on the packet evidence?
Answer and explanation
Correct answer: B
The combination of 'TCP Window Full' from the receiver and 'TCP Zero Window' probes from the sender is a classic indicator of a slow-receiving application. The server's TCP stack fills its receive buffer because the application isn't consuming the data. This causes it to advertise a window size of zero. The sender then periodically sends probe packets to check if the window has opened up. This points to an application-layer bottleneck on the server, not a network issue.
Question 3
A company has deployed a SteelCentral NetShark appliance to perform continuous packet capture in their data center. To conserve storage space, the network team wants to capture only the traffic related to their critical database servers, which reside in the 10.50.10.0/24 subnet. They also want to exclude all SSH (TCP port 22) management traffic from the capture. Which of the following NetShark capture job configurations would achieve this?
Answer and explanation
Correct answer: A
NetShark capture jobs use Berkeley Packet Filter (BPF) syntax. In BPF, net 10.50.10.0/24 correctly identifies traffic to or from the specified subnet. The and not port 22 clause correctly excludes traffic where the source or destination port is 22 (SSH). The other options use incorrect keywords or syntax not compatible with BPF for capture jobs.
Question 4
A large e-commerce company, 'ShopFast,' is preparing for its annual holiday sales event. Their primary customer-facing application is a multi-tier web service hosted in a hybrid cloud environment. In previous years, they experienced slowdowns where customers reported pages taking over 10 seconds to load, but the infrastructure team could not pinpoint the cause, blaming either the network, database, or web servers. This year, they have deployed SteelCentral AppResponse to gain deeper insight.
The key business requirement is to proactively identify which specific web pages and underlying database queries are contributing to poor user experience. The IT director wants a single metric that represents the end-user's perception of performance for every transaction. They also need the ability to drill down from a slow user session directly to the associated network and server metrics to facilitate rapid root cause analysis between the network, server, and application teams.
The current setup includes AppResponse monitoring traffic from a SPAN port in front of the web server farm. The network team has confirmed that all client-to-server and server-to-database traffic is visible to the appliance. The goal is to isolate the 'blame' for slowdowns to either network latency, server processing time, or specific application components.
Which AppResponse capability is most critical for ShopFast to configure and monitor to meet the IT director's requirement for a single, user-centric performance metric and enable blame-domain isolation?
Answer and explanation
Correct answer: D
Defining Web Business Transactions allows AppResponse to group related web hits into a single logical user action (e.g., 'Add to Cart'). The End-User Experience (EUE) time for these transactions is the exact user-centric metric the director needs. EUE time is further broken down into client time, network time, and server time, providing the necessary blame-domain isolation for drill-down analysis. This directly addresses all parts of the scenario's requirements.
Question 5
True or False: The primary function of the SteelCentral Flow Gateway is to perform deep packet inspection (DPI) and generate application-level performance metrics.
Answer and explanation
Correct answer: B
The statement is false. The primary function of the SteelCentral Flow Gateway is to collect, deduplicate, and forward flow records (like NetFlow, sFlow, IPFIX) from network devices to a SteelCentral NetProfiler. It does not perform deep packet inspection (DPI); that is a function of appliances like a SteelCentral Sensor or AppResponse.
Question 6
Multiple answers
A network administrator is configuring Host Groups in SteelCentral NetProfiler to better organize and report on traffic from different company departments. What are two key benefits of using Host Groups? (Select TWO)
Answer and explanation
Correct answers: B, D
Host Groups aggregate IP addresses into logical containers, which is essential for reporting on the traffic patterns of entire departments, server farms, or branch offices as a single entity.
Using logical names for Host Groups in service definitions, report filters, and policies makes the configuration more readable, manageable, and less prone to error than maintaining long, static lists of IP addresses.
Question 7
An engineer is analyzing a performance issue in a three-tier application using data from a NetShark appliance. The analysis shows significant delays. The engineer suspects the issue is between the Application Server and the Database Server. The following diagram represents the TCP round-trip time (RTT) measurements from the NetShark's perspective. Given the data presented, where is the most likely source of the application delay?
sequenceDiagram
participant Client
participant AppServer as Application Server
participant DBServer as Database Server
Client->>AppServer: HTTP Request
Note right of Client: Network RTT (Client-App): 20ms
AppServer->>DBServer: SQL Query
Note right of AppServer: Server Processing: 50ms
Note right of AppServer: Network RTT (App-DB): 150ms
DBServer-->>AppServer: SQL Result
Note left of DBServer: DB Processing: 30ms
AppServer-->>Client: HTTP Response
Answer and explanation
Correct answer: C
The diagram clearly shows the breakdown of time spent in each segment. The Network RTT between the Application Server and the Database server is 150ms, which is the largest single component of delay. This indicates that the most significant bottleneck is the network segment connecting these two tiers.
Question 8
A network operations team uses SteelCentral Portal to display a consolidated view of network and application performance. The team lead wants to create a custom dashboard that shows the top 10 applications by bandwidth from NetProfiler alongside the top 5 web applications by user experience time from AppResponse. Which Portal feature should be used to accomplish this?
Answer and explanation
Correct answer: C
SteelCentral Portal uses widgets as the building blocks for dashboards. Each widget is designed to pull specific data from a configured data source (like NetProfiler or AppResponse). To create the desired view, the administrator would create a new dashboard and then add the appropriate 'Top N Applications' widget from the NetProfiler data source and the 'Top N Web Applications' widget from the AppResponse data source.
Question 9
When using SteelCentral Transaction Analyzer to troubleshoot a multi-tier application, what is the primary purpose of creating a 'Transaction' model?
Answer and explanation
Correct answer: B
A 'Transaction' model in Transaction Analyzer is used to stitch together individual packet traces from different tiers (e.g., web, application, database) into a single, cohesive end-to-end view. This allows an analyst to visualize the message flow, identify which tier introduces the most latency, and understand the complete response time breakdown for a user's action.
Question 10
A company is deploying SteelCentral NetProfiler Enterprise, which consists of a separate database, application, and web server. What is the primary reason for this distributed architecture compared to the all-in-one NetProfiler appliance?
Answer and explanation
Correct answer: C
The distributed architecture of NetProfiler Enterprise is designed for scalability. By separating the database, application processing, and web interface onto dedicated servers, each component can be scaled independently to handle very high flow volumes (millions of flows per minute) and store massive amounts of historical data, which is common in large enterprise or service provider networks.
