N10-009 Question 207
Select 2A network administrator is troubleshooting recurring complaints that a business-critical application becomes slow for about 20 minutes each morning. Users can still reach the server during the slowdown, but file transfers and database transactions take much longer than usual. The administrator also needs to be alerted if a core switch goes offline and wants a record of any unauthorized device or configuration changes on the network over time. Which set of solutions would BEST meet these requirements?
- A
Deploy traffic analysis and performance monitoring, plus scheduled network discovery and configuration monitoring
- B
Deploy ad hoc network discovery only when users report problems, because it can identify outages, bandwidth issues, and configuration drift in one step
- C
Deploy availability monitoring only, because the server is still reachable and availability tools can also baseline throughput and detect unauthorized configuration changes
- D
Deploy traffic analysis and availability monitoring, but skip scheduled discovery because discovery scans are only useful during initial network installation
- E
Deploy performance monitoring and availability monitoring, plus scheduled network discovery and configuration monitoring
Show answer and explanation
Correct answers: A, E
Explanation
The scenario requires multiple monitoring disciplines because no single tool category covers all needs. For the recurring slowdown, performance monitoring is essential to establish a baseline and identify deviations in latency, utilization, throughput, or resource consumption. Traffic analysis is also highly valuable when the goal is to determine what traffic is contributing to the slowdown, such as backup jobs, replication bursts, or excessive broadcast/multicast traffic during the affected period. For outages, availability monitoring is the standard solution because it continuously checks device or service reachability and can generate alerts when a core switch becomes unavailable. To detect unauthorized devices appearing on the network over time, scheduled network discovery is preferred over ad hoc discovery because it provides recurring scans and comparison against prior results. To track unauthorized setting changes, configuration monitoring is the appropriate solution because it records and alerts on device configuration changes. These distinctions align with common network operations best practices used in enterprise monitoring platforms and with standard vendor documentation for network management systems: discovery identifies what is present, availability confirms what is up, performance shows how well it is operating, traffic analysis shows what is flowing, and configuration monitoring shows what has changed.
- A. Correct.
Correct. Traffic analysis helps identify what is consuming bandwidth or causing abnormal traffic patterns during the 20-minute slowdown window. Performance monitoring tracks metrics such as latency, throughput, interface utilization, CPU, and memory to validate and trend the degradation. Scheduled network discovery helps identify new or unauthorized devices over time rather than relying on one-time checks. Configuration monitoring provides a record of changes to device settings and can alert on unauthorized modifications. This combination directly addresses slow performance, outage alerting, rogue-device detection, and configuration drift. Availability monitoring is not explicitly named here, so this option is slightly less complete than option 5 for the offline core-switch alert requirement, but traffic analysis is very strong for diagnosing the slowdown itself.
- B. Incorrect.
Incorrect. Ad hoc discovery is useful for one-time or immediate scans, such as validating what devices are present right now, but it does not replace ongoing performance monitoring, traffic analysis, availability monitoring, or configuration monitoring. A common misconception is that discovery tools alone can reveal why an application is slow or track configuration drift over time. Discovery identifies devices and topology; it does not by itself provide continuous baselining, outage alerting, or detailed traffic behavior analysis.
- C. Incorrect.
Incorrect. Availability monitoring is appropriate for determining whether a host or service is reachable and for alerting when a device goes offline, but it does not by itself provide detailed throughput baselines, packet-flow visibility, or configuration change tracking. Someone might choose this because the issue mentions reachability, but the scenario clearly distinguishes between a reachable system and a slow one, which requires performance-focused tools and often traffic analysis.
- D. Incorrect.
Incorrect. Traffic analysis and availability monitoring would help with diagnosing congestion and detecting outages, but skipping scheduled discovery would leave a gap in identifying unauthorized devices over time. The statement that discovery scans are only useful during initial installation is false. Scheduled discovery is commonly used in operational environments to maintain an accurate inventory and detect changes in network topology or attached devices.
- E. Correct.
Correct. Performance monitoring is the best fit for trending and identifying application and network slowdowns when systems remain reachable but operate below normal levels. Availability monitoring is the right tool to alert if a core switch goes offline. Scheduled network discovery is appropriate for identifying unauthorized or newly added devices over time, and configuration monitoring tracks changes to device settings and can alert on unauthorized modifications. This is the most complete answer because it covers all four requirements in the scenario: slowdown investigation, outage alerting, unauthorized device detection, and configuration change tracking.