N10-009 Question 206
Single answerA network administrator is investigating intermittent voice quality problems on a campus network. Users report that VoIP calls become choppy for 10 to 15 minutes at unpredictable times, but devices do not go offline. The administrator already has an availability monitor that confirms switches and routers remain reachable during the incidents. The team wants a solution that will identify what is consuming bandwidth during those periods without waiting for the next outage to manually log in to each device. Which solution would BEST meet this requirement?
- A
Deploy traffic analysis using flow data or packet captures to review bandwidth usage patterns during the affected time windows
- B
Run ad hoc network discovery scans from the core switch each time a user reports poor call quality
- C
Rely on availability monitoring alerts to determine which application is causing congestion
- D
Use configuration monitoring only to compare current device settings against the last approved baseline
Show answer and explanation
Correct answer: A
Explanation
The key clue is that the problem involves intermittent performance degradation rather than outages. When voice quality is affected but network devices remain available, the next step is usually performance-focused investigation, especially traffic analysis. Best practice is to collect flow telemetry such as NetFlow, sFlow, or IPFIX, or use packet capture at strategic points, to determine whether specific hosts, applications, backups, replication jobs, or broadcast storms are consuming bandwidth or increasing latency and jitter during the affected windows. Availability monitoring answers 'Is it up?', while performance and traffic analysis answer 'How well is it working?' and 'What is using the network?'
Ad hoc and scheduled discovery are useful for asset visibility and identifying unexpected devices, but they are not the primary tools for diagnosing transient congestion. Configuration monitoring is important for detecting drift from approved baselines and can help rule out policy changes, but it does not replace traffic analysis for utilization-based problems. These distinctions align with common network operations best practices and standard vendor guidance for monitoring: use availability monitoring for reachability, performance monitoring for latency/utilization trends, traffic analysis for flow-level visibility, and configuration monitoring for change detection.
- A. Correct.
Correct. Traffic analysis is the best fit because the issue is not device reachability but intermittent congestion or abnormal traffic patterns affecting call quality. Using NetFlow, sFlow, IPFIX, or targeted packet captures allows the administrator to identify which hosts, applications, or conversations are consuming bandwidth during the problem periods. This directly addresses the need to understand utilization without depending on someone to manually inspect devices at the moment of the incident.
- B. Incorrect.
Incorrect. Ad hoc network discovery is useful for identifying devices currently on the network, especially when checking for unauthorized or newly connected systems. However, it does not show which applications or traffic flows are consuming bandwidth over time. It also depends on manually running scans after reports come in, which does not meet the requirement to capture data during unpredictable events.
- C. Incorrect.
Incorrect. Availability monitoring confirms whether devices or services are up or down, often through methods such as ICMP, SNMP status polling, or service checks. In this scenario, the administrator already knows the infrastructure remains reachable. Availability data alone does not identify the source of congestion or reveal which traffic is degrading VoIP quality.
- D. Incorrect.
Incorrect. Configuration monitoring is valuable for detecting unauthorized or unintended changes to device settings, such as QoS policy modifications, interface changes, or routing updates. While configuration drift could potentially contribute to performance problems, configuration monitoring by itself will not show what is actively using bandwidth during the 10 to 15 minute periods of degraded call quality.