201-01 Riverbed Certified Solutions Associate - Network Performance Management Practice Questions
Prepare for 201-01 with more than an answer.
- Exam fee
- $250 USD
- Level
- Associate
- Valid for
- 2 years
Domains covered on the exam 7
- General Knowledge10%
- SteelCentral NetProfiler, NetExpress, and Flow Gateway25%
- SteelCentral Packet Analyzer20%
- SteelCentral NetShark20%
- SteelCentral AppResponse15%
- SteelCentral Transaction Analyzer5%
- SteelCentral Portal5%
- 1
A retail company is investigating slow credit card transaction times at its stores. The network topology involves transactions flowing from a Point-of-Sale (POS) terminal to a central data center. An administrator wants to use a Riverbed product to capture the exact packets for a specific transaction and analyze the message-level details of the authorization protocol. Which product is best suited for this task?
Show answer details
Correct answer: C
SteelCentral Packet Analyzer is the primary tool for deep, granular analysis of network packets. Its purpose is to decode protocols, analyze individual conversations, and allow engineers to inspect the payload and message-level details of a transaction. This makes it the ideal choice for troubleshooting a specific protocol interaction like a credit card authorization.
- 2
When configuring a SteelCentral Flow Gateway, what is the purpose of the 'Flow Deduplication' feature?
Show answer details
Correct answer: A
In many networks, a single traffic conversation may pass through multiple routers or switches that are all exporting flow data. This results in duplicate flow records for the same conversation. The Flow Gateway's deduplication feature intelligently identifies and discards these redundant records, ensuring that NetProfiler receives a clean, accurate data set and reducing the processing load on the NetProfiler appliance.
- 3
An administrator creates a 'View' in SteelCentral NetShark to isolate traffic for a specific web server. What is the primary benefit of creating a View instead of downloading the entire packet capture?
Show answer details
Correct answer: C
NetShark Views are a powerful feature for 'packet mining'. A View acts as a pre-indexed, filtered subset of the massive capture store on the appliance. This allows an analyst to work with a manageable and relevant data set (e.g., just the packets for one server over a 10-minute window) directly on the NetShark appliance. This avoids the time-consuming process of transferring potentially terabytes of raw packet data across the network for analysis.
- 4
A manufacturing company uses a critical SCADA application that communicates over a custom TCP protocol. The application frequently times out, and the developers blame the network. The network team has captured packets using Packet Analyzer and wants to visualize the timing and sequence of messages between the client and server to identify where delays occur. Which Packet Analyzer feature is specifically designed for this purpose?
Show answer details
Correct answer: B
The TCP Sequence Diagram, also known as a Time-Sequence Graph, is a powerful visualization tool in Packet Analyzer. It plots TCP sequence numbers over time, clearly showing the flow of data, acknowledgements, retransmissions, and delays between two endpoints. This makes it the ideal feature for understanding the ladder-like interaction of a client-server protocol and pinpointing where in the sequence the application is stalling.
- 5
In SteelCentral AppResponse, what is the primary data source for calculating the 'User Experience Time' for a web application?
Show answer details
Correct answer: C
AppResponse calculates user experience metrics by performing deep packet inspection on the actual network traffic. It analyzes the TCP and HTTP/S conversations to measure network delay, server delay, and content download times, which are combined to determine the overall user experience. This method provides real-world performance data without requiring agents on servers or clients.
- 6
A financial services company is experiencing intermittent latency with their online trading platform during peak hours. The network team uses SteelCentral NetProfiler to monitor traffic. They've noticed that while overall bandwidth utilization is acceptable, certain TCP connections show high 'Server Delay'. To investigate further, they need to isolate traffic specifically for the trading application, which uses a proprietary protocol on TCP port 3307. Which NetProfiler feature is most effective for creating a dedicated, long-term view of this specific application's performance metrics?
Show answer details
Correct answer: B
Defining a new Application in NetProfiler is the best approach for long-term, dedicated monitoring. This allows NetProfiler to baseline the traffic, generate specific performance metrics (like network vs. server delay), and trigger alerts for this application as a distinct entity. While custom reports and ad-hoc filters are useful for temporary analysis, an Application Definition provides persistent, structured monitoring.
- 7
A network engineer is using SteelCentral Packet Analyzer to diagnose a slow file transfer issue between a client and a server. The packet trace shows multiple TCP segments with the 'TCP Window Full' message from the receiver (server). Concurrently, the sender (client) exhibits several 'TCP Zero Window' probes. What is the most likely root cause of this performance problem based on the packet evidence?
Show answer details
Correct answer: B
The combination of 'TCP Window Full' from the receiver and 'TCP Zero Window' probes from the sender is a classic indicator of a slow-receiving application. The server's TCP stack fills its receive buffer because the application isn't consuming the data. This causes it to advertise a window size of zero. The sender then periodically sends probe packets to check if the window has opened up. This points to an application-layer bottleneck on the server, not a network issue.
- 8
A company has deployed a SteelCentral NetShark appliance to perform continuous packet capture in their data center. To conserve storage space, the network team wants to capture only the traffic related to their critical database servers, which reside in the 10.50.10.0/24 subnet. They also want to exclude all SSH (TCP port 22) management traffic from the capture. Which of the following NetShark capture job configurations would achieve this?
Show answer details
Correct answer: A
NetShark capture jobs use Berkeley Packet Filter (BPF) syntax. In BPF,
net 10.50.10.0/24correctly identifies traffic to or from the specified subnet. Theand not port 22clause correctly excludes traffic where the source or destination port is 22 (SSH). The other options use incorrect keywords or syntax not compatible with BPF for capture jobs. - 9
A large e-commerce company, 'ShopFast,' is preparing for its annual holiday sales event. Their primary customer-facing application is a multi-tier web service hosted in a hybrid cloud environment. In previous years, they experienced slowdowns where customers reported pages taking over 10 seconds to load, but the infrastructure team could not pinpoint the cause, blaming either the network, database, or web servers. This year, they have deployed SteelCentral AppResponse to gain deeper insight.
The key business requirement is to proactively identify which specific web pages and underlying database queries are contributing to poor user experience. The IT director wants a single metric that represents the end-user's perception of performance for every transaction. They also need the ability to drill down from a slow user session directly to the associated network and server metrics to facilitate rapid root cause analysis between the network, server, and application teams.
The current setup includes AppResponse monitoring traffic from a SPAN port in front of the web server farm. The network team has confirmed that all client-to-server and server-to-database traffic is visible to the appliance. The goal is to isolate the 'blame' for slowdowns to either network latency, server processing time, or specific application components.
Which AppResponse capability is most critical for ShopFast to configure and monitor to meet the IT director's requirement for a single, user-centric performance metric and enable blame-domain isolation?
Show answer details
Correct answer: D
Defining Web Business Transactions allows AppResponse to group related web hits into a single logical user action (e.g., 'Add to Cart'). The End-User Experience (EUE) time for these transactions is the exact user-centric metric the director needs. EUE time is further broken down into client time, network time, and server time, providing the necessary blame-domain isolation for drill-down analysis. This directly addresses all parts of the scenario's requirements.
- 10
True or False: The primary function of the SteelCentral Flow Gateway is to perform deep packet inspection (DPI) and generate application-level performance metrics.
Show answer details
Correct answer: B
The statement is false. The primary function of the SteelCentral Flow Gateway is to collect, deduplicate, and forward flow records (like NetFlow, sFlow, IPFIX) from network devices to a SteelCentral NetProfiler. It does not perform deep packet inspection (DPI); that is a function of appliances like a SteelCentral Sensor or AppResponse.
