*70-291 Practice Questions*

Webmaster

I planned one for the Network Security domain, but turned out writing one for the "Maintaining a Network Infrastructure" domain...

11. You are the network administrator at a large law firm with 400 Windows XP computers and 15 Windows 2003 servers. Your network is divided into two subnets, each using a class C network address, and connected by a Windows 2003 Server running RRAS.

80 Windows XP clients from the Sales department are located in the same subnet. Users from this department frequently complain about the overall performance of the network. After investigating the problem, you suspect that the network is being saturated with excessive broadcast traffic.

Which of the following tasks allows you to identify the largest broadcaster on the subnet?

a. Run System Monitor on one of the clients to gather network statistics for all of the clients.
b. Run Performance Logs and Alerts on each client to gather network statistics for each individual computer.
c. Run the Network Monitor from SMS server to capture all broadcast traffic on the subnet.
d. Run Network Monitor to capture all traffic and sort the Broadcasts Sent column.

eurotrash

total guess here (or rather, process of elimination)

A - i think system monitor can gather statistics for only one computer at the time. then i don't think it will even show which computer is sending the broadcasts (can you even specify broadcats? i forget...).
B - that would require too much administrative effort (HA! i'm starting to pick up microsoft's irritating ways).
C - we don't have an SMS server (at least, none was mentioned).
D - sounds the best.
it would work, because all computers will pick up the broadcasts (including the server in question) and with network monitor i will be able to see who's ip or mac address is spamming the network.

thanks for the questions! keep up the good work

Webmaster

Now that you mention it, there's no SMS server... when you read the explanation it'll be obvious why I threw SMS in their. I think I'll change the question a bit, and add an SMS server to network, and some IP addressing info.

You're most welcome, and thanks for answering them. The direct response in the topic is definitely helpful for testing the questions before I add them to the test engine.

eurotrash

when you read the explanation it'll be obvious why I threw SMS in their.

i think i know why you did - because sms server comes with the full version of netmon which can be run in promiscuous mode...yeah i think i would have chosen that had there been an sms server around.

Webmaster

Exactly. The network monitor included in SMS can monitor network traffic for remote computers as well. While the network monitor included in Windows 2003, can only be used to monitor network traffic targeted at its own local NICs, which includes broadcast traffic from all other systems in the subnet. Full explanation of correct and incorrect answers tomorrow, and hopefully a question about the Network Security domain.

Webmaster

I don't have a new question yet, but I see I haven't posted the answer for previous one yet, although _omni_ explained it already. The answer to question 11 is indeed D.

System Monitor and Performance log and alerts can track te number of non-unicast packets (hence broadcast and multicast) but does not log the source address. Monitoring the each individual computer would work, but would indeed require too much administrative effort.

The network monitor included in SMS can monitor network traffic for remote computers, while the network monitor included in Windows 2003, can only be used to monitor network traffic targeted at its own local NICs, but this includes broadcast traffic from all other systems in the subnet so the regular Windows 2003 version of Network Monitor will do. Sorting the Broadcasts Sent column of the results allows you to identify the largest spammer on the network.


Exam Objectives:
- Monitor network traffic. Tools might include Network Monitor and System Monitor.

Reference: Identify the largest broadcaster on the network

Reference 2: [url=http://technet2.microsoft.com/WindowsServer/en/Library/6ec6dd78-2237-4118-9595-b1d15e274a511033.mspx
]Network Monitor overview[/url]

RTmarc

I don't know if this is the right spot or if I even read the question correctly but I think I found a typo. The answer for the question that begins:

5. You are the network administrator at a large law firm with 400 Windows XP computers and 15 Windows 2003 servers in a single Active Directory domain. The computers and servers are divided over 2 subnets that are connected by a RRAS server as shown in the following diagram.

does not appear to have a correct answer listed in the solution. Granted the answers is indeed there, I think it's just typed wrong.

This is the phrase:

Answer D is incorrect because you don't need to authorize a DHCP server separately for different subnets.

D, I believe, needs to be changed to B.

Webmaster

I see what you mean, the ABCD in the explanation doesn't line up with the available answers even though the correct answer is the correct answer in our test engine. Fixed that, thanks for letting me know.


On a side note, I'll probably won't be updating this topic with new questions for the next several weeks, but will eventually start covering other exam objectives, so that's why this topic is still a sticky.

mariegenia

Hello, just to thank you like 2 years latter your Q&A.