Insights and Alerts (25%)

300-445 · 75 questions

• A university edge router keeps dropping and restoring its BGP session toward the upstream provider. What should notify the network team?
• A hospital path that had been clean now shows TCP retransmissions climbing toward the imaging archive. What should page the network team about that condition?
• At a retail chain, interface error counters on a store uplink are rising while user CPU on the registers stays ordinary. Which response fits that network condition?
• A bank network operations center wants a page when Internet Insights reports a disruption on providers the bank uses. Which action does that?
• A government agency watches SNMP and sees one WAN interface stay pinned at full utilization through the workday. Operators want a page when that condition returns. Which alert fits?
• At a SaaS company, syslog on a border router starts repeating the same hardware fault. The on-call team wants a page when that message returns. Which alert fits?
• A logistics hub loses the VPN tunnel to the regional warehouse, and the tunnel state stays down. What should page the network team?
• At a manufacturer, packet loss appears in the same windows as MPLS label-switched path changes. What should page the WAN team?
• At a hotel chain, NetFlow shows guest traffic suddenly shifting onto one WAN interface while the other circuits stay quiet. The NOC wants a page when that shift happens again. Which response fits?
• A university network team wants an on-call page when tests show loss on the path to the learning system, and they have said a laptop fan is not that page. Which action matches the request?
• A manufacturer collects BGP session state, interface errors, and throughput toward a plant peer, and wants a page only when that BGP session leaves the established state. Which action matches the request?
• On event days at a stadium, WAN throughput falls below the level the operations team treats as normal, and they want a page when that drop returns. Which alert fits?
• A hospital campus sees drops concentrated in one traffic class while other classes on the same circuit stay clear. Operators want a page for that condition. Which alert fits?
• A retailer's edge router loses the expected prefix from its BGP table, and the branches that depend on that prefix go dark. The NOC wants a page when the prefix disappears. Which alert fits?
• A bank agreed that delay on the path to the trading service would page the network team once it crossed a line they had set, and that delay has now crossed the line. Which response fits the agreement?
• At a manufacturer, user tickets open at the same minutes the client Wi-Fi signal collapses, and the WAN path stays quiet. Which alert matches that evidence?
• Students at a university report long waits inside the browser, endpoint browser data shows those same waits, and the campus edge routing looks unchanged. Which alert matches the symptom?
• Traders at a bank lose the market application when the VPN client on the endpoint disconnects, and endpoint data records that disconnect. Which alert matches the symptom?
• Clinicians at a hospital campus report that a soft client fails at the same moments endpoint data shows the laptop CPU spiking. Which alert matches that user-experience symptom?
• Cashiers at a retailer move from the wired counter onto the wireless floor, and the point-of-sale application drops during that change. Which alert matches the user symptom?
• At a logistics hub, dispatch screens freeze only while the client CPU is saturated, and the WAN path stays clean. Which alert should watch that failure?
• A hotel chain sees the browser error rate climb on guest devices while path loss on the same tests stays low. Which alert fits that pattern?
• At a hospital campus, browser tests fail only on laptops running one Endpoint Agent version, while every other version reaches the same portal. Which alert matches that pattern?
• Branch laptops at a retailer show climbing Wi-Fi retries on the endpoint while the store WAN circuit stays clean. Which alert should page the team?
• A government agency sees the user failure at the moment the endpoint flips from a wired connection to wireless. Which rule should catch that change?
• Remote staff at a SaaS company lose their VPN while probes inside the office stay green for the same applications. Which rule matches those failures?
• During events, a stadium pages the WAN on-call for freezes that line up with client CPU saturation while the path stays clean. What should the rule watch instead?
• At a bank, teller browsers stall on one loan page while CPU on those PCs stays low and the branch VPN stays up. Which alert fits the symptom the tellers named?
• A retailer with branch stores wants a weekly view of store experience, because leadership cannot use a separate page for every interface flap. Which deliverable fits that audience?
• Hospital network operators need a live view they can act on tonight when a clinical path degrades. Which deliverable matches that audience?
• A university VPN drop is visible in endpoint data, but the only notice today is a weekly executive dashboard the on-call team does not read. What should notify the people who respond?
• A manufacturer pages the network on-call from a core-router SNMP trap each time a laptop roams between access points. Which rule fits this symptom?
• At a university, the application team asks which student-portal transaction is failing and says interface SNMP graphs do not help them. Which view should they receive?
• Production support at a bank asks for the open alert together with the tests that ran around the same time, so they can work the incident. Which deliverable matches that request?
• Leaders at a logistics hub ask for a one-page experience score they can read in a staff meeting. Which deliverable matches that request?
• A government agency's production support desk needs proof that last night's network alert both fired and later cleared so the ticket can close. Which deliverable matches that request?
• The network operations center at a manufacturer is working from executive slide decks and missing live faults. Which deliverable should that operations center receive?
• At a SaaS company with remote staff, operators were sent the monthly executive trend and executives were sent the live alert-rule pack. Operations now asks for the pack that belongs to operators. Which deliverable should operators receive?
• Developers at a hotel chain ask which reservation API call slowed down after last night's release. Which deliverable should they receive?
• A retailer with branch stores pages store managers from the monthly business review whenever a branch alert flaps. Which audience should keep the live paging channel?
• A manufacturer already has an executive summary of plant network health, yet someone sent the board a CSV of raw flows. Which deliverable should the board receive?
• A hospital application team received a BGP table dump and cannot use it to see why the charting page is slow. Which deliverable should that team receive instead?
• A university has both network operations and a production support desk, and the support desk asks for the view it will use to work alerts. Which deliverable should support receive?
• On stadium event days, operators need the live alert rule and executives need the experience trend, yet both groups were sent one identical packet. What should be delivered instead?
• A bank emails every interface flap to executives, and those leaders have started ignoring the mail. How should the executive deliverable change?
• A bank lowered alert thresholds until ordinary transactions paged, and real incidents are now buried in that noise. Which step should the team take?
• A manufacturer expected a maintenance window to suppress a known alert, but the rule still pages while that window is in effect. Which step should the team take?
• A hospital campus saved a congestion alert rule and has not exercised it against any known congestion. Which step should the team take next?
• A retailer with branch stores has an alert that fires during an outage and stays open after the stores have recovered. Which step should the team take?
• A university acknowledged one test alert and then deleted the rule, so nothing remains that can fire or clear. Which step should the team take?
• At a logistics hub, two alert rules page the on-call phone for one path event, so every incident arrives twice. What should the team do to validate those rules?
• A retailer with branch stores sees one link flap generate a storm of pages for the same incident. What should the assurance owner do with the alert rule before trusting it in production?
• At a government agency, a dependency alert pages the desk only after the parent alert has already paged for the same event. What should the team do before changing either rule?
• A hospital campus saved an alert rule that matches a lab target and does not match the production service clinicians use. What should the team prove before depending on that rule?
• On event days at a stadium, an alert rule matches the condition, but the notification goes to a mailbox nobody monitors. What should the team prove before relying on that rule?
• A SaaS company with remote staff pointed an alert rule at a new test and left the previous test in place. What should the team do before trusting pages from that rule?
• A hotel chain's guest-experience alert fires during a dip and then clears while that dip is still in progress, so the page ends before the experience recovers. What should the team do to validate the rule?
• A manufacturer edited an alert rule, and the on-call owner still cites yesterday's validation of the old rule. What should happen before the edited rule is trusted?
• A hospital campus link runs full at the same hour every week, and an alert already pages for that fullness. What should the next deliverable be?
• A university spoke reaches its applications only by hairpinning through a congested hub, and delay stays high even though the spoke link itself is quiet. Which recommendation belongs in the capacity report?
• A retailer's voice calls are dropped because the voice class is too small, and those drops are already being alerted. What should the recommendation be?
• At a university, a dashboard widget stays green while the related alert rule keeps paging the on-call team. What is the right next step for that rule?
• At a bank, an alert rule passes a syntax check and an engineer treats that check as proof the rule works. What still has to happen?
• A SaaS company sees the link that serves remote staff stay full through the workday, and someone proposes renaming the dashboard as the response. Which action belongs in the capacity report?
• A logistics hub can fail over to a backup path, but that path is too thin to carry the traffic the primary path carries today. Which capacity recommendation addresses the finding?
• A hotel chain finds a guest-facing application marked into the wrong traffic class, so it contends with bulk transfers even though the circuit still has spare capacity. Which capacity recommendation fits?
• A government agency sees two sites sending traffic through a distant exit even though a closer exit is available and healthy. What should the capacity recommendation propose?
• A manufacturer's plant uplink stays full through production shifts, and the team is about to add a third alert for that same saturation. What should the capacity report recommend instead?
• A bank sees one traffic queue starve during the business day while the WAN interface carrying that queue is not full. Which item belongs in the capacity recommendation?
• A manufacturer already has a working alert for a congested plant circuit and now asks for the optimization that would relieve the congestion. What should the assurance deliverable be?
• A bank sees loss only in the backup traffic class while backups run, and interactive classes on the same circuit stay clean. What should the capacity recommendation be?
• A hospital campus circuit stays full through the day, and QoS already marks clinical traffic ahead of bulk transfers. What should the capacity recommendation be?
• A retailer runs a large file transfer during the branch busy hour, the circuit fills, and the transfer can shift to a quiet hour without hurting store sales. What should the capacity recommendation be?
• Every university spoke slows when its traffic hairpins through one hub, and that hub link is the bottleneck shared by all of the spokes. What should the capacity recommendation be?
• On event days a stadium uplink sits full, ticket sales slow, and the charts already show the circuit is saturated. More synthetic tests will not widen that circuit. What should the team recommend?