Hybrid-Cloud-Observability-Network-Monitoring Hybrid Cloud Observability Network Monitoring Exam Question and Answers

If the web console shows a router as “down” but it is actually operational:

ICMP is blocked: If the polling engine cannot ping the device, it will be reported as down.

SNMP is blocked: If SNMP polling fails (for devices polled via SNMP), detailed data and status cannot be retrieved, resulting in a down state.

Agent connection issues may apply for agent-based monitoring but are not typical for network routers. Node dependency configuration could affect child node status display but would not cause the parent node to show “down”.

When a device returns multi-core CPU statistics as a table, SolarWinds Device Studio allows you to use the " Add Calculated Value " option and select the average function. This enables the web console widget to display the computed average CPU utilization automatically.

The documentation explains:

" For devices with multi-core CPUs, you can use the Add Calculated Value feature in the Device Studio to compute the average (or other statistical functions) of returned table values, which can then be visualized directly in widgets. "

The best practices for creating a Universal Device Poller (UDP) in SolarWinds are:

Consult vendor documentation for OID: Always check the device/vendor documentation for the correct OID to monitor the desired metric.

Perform SNMPwalk to determine if OID exists: Use SNMPwalk to verify the OID’s existence and see if it is supported and returns the correct values from the device.

Calling SolarWinds support is not a standard step for obtaining OIDs, and WBemtest is a Windows tool for WMI, not SNMP/OID polling.

Exact Extract from Official Guide:

“Consult device vendor documentation for correct OIDs and perform SNMPwalk to ensure the OID exists and is supported by the device before creating a UDP.”

— (Network Performance Monitor Administrator Guide, “Best Practices for Universal Device Pollers” section)

When the SolarWinds Log Analyzer web console is in " live mode, " it automatically refreshes the log viewer data every 10 seconds by default, ensuring users see near real-time event streams.

The documentation states:

" In live mode, Log Analyzer refreshes data every 10 seconds to display the most recent events as they arrive. "

A node rediscovery updates all node and interface information, including names, IP addresses, captions, and interface aliases. Running a rediscovery on the node ensures all related interface details are refreshed in the SolarWinds database and web console.

Duplex mismatches often result in specific types of switch port errors. According to SolarWinds documentation, the most common indicators of a duplex mismatch include CRC errors (B), high receive error percentages (C), and collisions (D). These errors occur because one end of the link operates in full-duplex mode (no collisions expected), while the other operates in half-duplex (collisions possible), resulting in frame errors, dropped packets, and high CRC counts. The option " 100 MB full " refers to a speed/duplex setting, not an error.

For a transformer to correctly process and display a value, the custom poller used for transformation must be assigned to the same node; otherwise, the transformation cannot occur. Additionally, both the custom poller and the transformer must have the same polling interval to ensure synchronized data collection and processing. If their intervals do not match, the transformation can fail or display incorrect results.

For organizations with very large environments and strict requirements for data freshness and availability, SolarWinds documentation prescribes several specific steps:

A. Deploy multiple additional polling engines (APEs) in each regional datacenter and configure load balancing. " For environments exceeding 20,000 monitored interfaces, deploy multiple Additional Polling Engines (APEs) to distribute load and maintain polling intervals. Place APEs close to monitored devices to reduce latency. "

B. Implement SolarWinds High Availability (HA) pools for both the main and polling engine servers, with active-passive failover. " SolarWinds HA pools provide automatic failover for platform and polling engines, ensuring service continuity in case of hardware or network failures. "

C. Configure the SolarWinds database server in a Microsoft SQL Server Always On Availability Group. " To protect against database outages, deploy the SolarWinds database in a SQL Server Always On Availability Group or Failover Cluster Instance (FCI). "

Option D is incorrect; overlapping node groups are not a requirement and, in fact, the documentation suggests using dynamic assignment to balance load, not strictly static node groups.

SolarWinds Log Analyzer and Hybrid Cloud Observability support log collection from current, supported Windows operating systems, such as Windows 10 (workstation) and Windows Server 2019. Older or unsupported versions like Windows Vista or Server 2012 may not be supported.

SolarWinds capacity forecasting supports both peak and average calculation methods. Peak calculation uses daily maximum values and is better for critical devices or links where reaching a threshold must be avoided. Average calculation uses daily average values and is more appropriate for non-critical resources where temporary threshold exceedance is acceptable. The official SolarWinds documentation states that the forecast calculation method is set globally by default for monitored objects, but it can also be customized for individual objects such as nodes, interfaces, or volumes. That means the calculation can be configured globally and locally at object level. Memory usage and node threshold settings are metrics/settings areas, not the two calculation-scope locations.

The Flow Navigator in SolarWinds NetFlow Traffic Analyzer (NTA) is a powerful custom filter and analysis tool. It enables users to apply multiple filters to NetFlow data, allowing the visualization of specific statistics about the entire network or selected subsets, such as all traffic from a certain IP range or application. This approach eliminates the need to manually click through device-by-device views, instead providing comprehensive traffic analysis across the whole monitored environment through a single, customizable interface.

Device Studio supports the following data sources:

Calculated result from transformation of polled values: You can apply calculations (such as average, sum, transformation) to the raw polled data.

Polled value by a device on an object ID: Device Studio can directly poll an OID from a device and use its value for monitoring.

Night/day standard deviation and predicted/baseline values are not direct data sources in Device Studio.

SolarWinds NTA maps flow sources to nodes by matching the IP address. If a device exports flows using a secondary IP (not the one defined as " primary " in SolarWinds), and the setting " Allow matching by other IPs " is not enabled, the flow will not map to a known node. The documentation explains:

" If flow packets are received from an IP address not designated as primary in SolarWinds, and matching by other IPs is disabled, the flow source is not linked to a node. Enable the setting to match by any device IP to resolve this issue. "

Capacity forecasting accuracy is directly impacted by:

Amount of historical data used: More historical data provides better trend analysis.

Exhaustion calculation method: Different methods (e.g., linear, peak, moving average) affect how forecasts are calculated.

Polling interval: More frequent polling increases granularity and the accuracy of forecasting.

Warning thresholds (D) do not affect the precision of forecasts, only the alerting behavior.

Universal Device Pollers (UDPs) in SolarWinds are tightly coupled with the polling engine on which they are configured. If the main polling engine fails, custom pollers do not automatically failover; as a result, statistics collection for those UDPs is interrupted. According to SolarWinds documentation:

" UDPs are assigned to a specific polling engine. If the polling engine fails, UDP statistics are not collected until the engine is restored. "

" Universal Device Pollers are not supported on failover engines; they do not collect data from hot standby or failover engines. "

Thus, options C and D directly reflect the official guidance.

For a node-specific log view, navigate to the node’s details summary and choose “Analyze Logs” under the Management section. This provides a filtered view of log messages for the selected node, allowing you to drill into relevant log events and details.

From the documentation:

“To view logs for a specific node, open Node Details > Management > Analyze Logs for node-level log analysis and troubleshooting.”

Universal Device Pollers (UDPs) are tied to the polling engine on which they are created. This means if a UDP is created on the main polling engine, it will only collect data for devices polled by that engine. To collect data from devices polled by an additional polling engine, you must create or assign the UDP on that engine as well.

Exact Extract from Official Guide:

“Universal Device Pollers are tied to the polling engine on which they are created. To monitor devices assigned to an Additional Polling Engine, the UDP must be created or assigned on that engine.”

— (Network Performance Monitor Administrator Guide, “Universal Device Pollers” section)

If devices respond to SNMP queries individually but aren ' t discovered during network scans, the most likely cause is the discovery timeout value being set too low. This can result in slower devices timing out before responding to discovery requests, even though they are operational and SNMP-enabled.

The documentation explains:

" If devices are not discovered but respond to SNMP queries, increase the discovery timeout and retry. Short timeouts can cause missed responses from devices that take longer to reply during scanning. "

To monitor and configure High Availability (HA) mode for site-to-site VPN tunnels on a Cisco ASA firewall, SolarWinds uses SNMP for standard device and interface metrics, and CLI polling for advanced VPN and HA state details. SNMP provides general health data, while CLI polling (using Device Studio or Network Insight) collects information not available via SNMP, such as detailed VPN and HA status.

If a device studio poller is configured with a static textual value (rather than a dynamic OID), any change in the actual value on the node will not be detected automatically; the poller’s configuration must be manually updated to reflect the new value. OID-based pollers update automatically as values change on the device.

List Resources: When you add or manage a node, the List Resources page allows you to enable or verify hardware health monitoring options.

Manage Sensors: This section allows you to directly manage the hardware sensors (such as fans, power supplies, and temperature sensors) that report health status.

Device view and node properties are not the primary locations for enabling or managing hardware health sensors.

To edit trigger conditions for flow alerts in SolarWinds, the SolarWinds Query Language (SWQL) is required. SWQL is a proprietary subset of SQL designed specifically for the SolarWinds Orion Platform. The documentation specifies:

“Editing advanced alert trigger conditions and custom queries for flow-based alerts requires the use of SWQL, not PowerShell, Python, or standard SQL.”

Device Studio pollers can use manually defined OIDs when the required OID is not present in the SolarWinds MIB database. SolarWinds documentation specifically describes the option to select Manually Define Object Identifier (OID) , type the OID name and value, select the SNMP get type, and poll the current value from the test node. That makes option A correct. Option B is wrong because if the target device itself does not support or return the OID, SolarWinds cannot poll that value. Option C is wrong because Device Studio can poll multiple OIDs for a given technology. Option D is too broad; SolarWinds says Device Studio values are displayed in existing resources, not that every result becomes a separate widget.

===============

NetPath probes require a supported Windows environment for deployment. According to the SolarWinds documentation, probes can be run from the Hybrid Cloud Observability (HCO) server itself, which must be a Windows server, or from any Windows client computer, including Windows 10. NetPath agents are not available for Linux or for network devices such as routers; the agent cannot be installed on Red Hat Linux or routers.

Universal Device Pollers (UDPs) must be explicitly assigned to each node for which custom polling is required. Adding a new node does not automatically assign existing UDPs to that node, even if it’s the same device type as others already using the poller. Assigning the existing UDP to the new node will resolve the issue and enable polling of the desired data.

Device Studio is specifically designed to build custom pollers for missing or vendor-specific metrics that are not natively included in node details. It is best used to enrich the node details with custom OID-based metrics from devices.

From the documentation:

“Use Device Studio to build pollers for new metrics not present in the default node details, particularly for custom or third-party equipment.”

When you create a flow alert in SolarWinds, the object of the alert (such as a specific interface, node, or application) is chosen from the “Create a Flow Alert” panel. Flow alerts are not based on custom SQL queries, require the NetFlow service to be running, and always have associated trigger actions.

If a node is up but its interfaces show as “unknown,” this usually means the interfaces are not currently being managed/monitored in the SolarWinds platform.

From the documentation:

“If interfaces are not selected for management during discovery or have been removed from monitoring, their status appears as ‘unknown’ even though the parent node is up.”

SolarWinds provides several statistics for network capacity planning, most notably:

Memory usage data on nodes: Useful for forecasting resource exhaustion on network devices.

Receive utilization on interfaces: Essential for predicting bandwidth saturation and planning upgrades.

The documentation states:

" Key statistics for network capacity planning include interface utilization trends (receive and transmit) and memory utilization, which allow for forecasting and proactive infrastructure management. "

Hiding an IP address group in IPAM management means that group will not appear in dashboards, charts, or reports, but the underlying data and group definition remain intact and are not deleted.

If flows are confirmed as reaching the poller but no data appears in the web console, the most common cause is a missing or incorrect source address field in the flow configuration on the sending device. SolarWinds uses the source address to match incoming flows to the correct device record in its database; if this field is missing or misconfigured, the data will not be processed or displayed.

Exact Extract from Official Guide:

“If the source address field is missing or incorrectly configured in the flow-exporting device, the system cannot associate the flow with a monitored device, and no data will appear in the console.”

— (Network Performance Monitor Administrator Guide, “Troubleshooting NetFlow” section)

The Brocade G620 switch is not supported by SolarWinds for hardware health statistics collection, regardless of the SNMP version or polling method used. SolarWinds documentation lists the specific switch models and vendors that are compatible with hardware health monitoring, and Brocade switches (including the G620) are not among the supported models for this feature.

The documentation states:

“Hardware health monitoring in SolarWinds is available for a set of supported vendors and models. Brocade G620 is not included in the list of devices that provide hardware health statistics. As a result, these statistics will not appear on the node details summary page, even if SNMP polling is enabled and working for other metrics.”

Flow sampling reduces resource usage by analyzing a subset of traffic. The following protocols support sampling:

Cisco NetFlow (except v1): Most NetFlow versions support sampling.

IPFIX: Supports flow sampling as part of its standard.

NetFlow Lite: Designed to provide sampled flow data.

NetFlow V1 does not support flow sampling.

Exact Extract from Official Guide:

" NetFlow (except v1), IPFIX, and NetFlow Lite support flow sampling, enabling high-performance monitoring of large traffic volumes. "

— (Network Performance Monitor Administrator Guide, “Flow Protocols and Sampling” section)

You can check the status of the flow collector service from the NetFlow collector services section and from NetFlow settings in the SolarWinds web console. These locations provide service health, up/down status, and logs. " Flow and CBQoS sources " and " Top XX receivers " do not display service health.

In SolarWinds, the OID description is determined by the MIB database. If a particular OID description is missing or incorrect, the recommended action is to update the MIB database. This can be done by requesting the latest MIB database from SolarWinds support, which regularly releases updates to support new devices and OIDs.

SolarWinds identifies and classifies flow traffic based on application and port mapping in the platform.

" Unclassified traffic in flow charts often occurs when an application is not mapped in the system, or when the application uses a port that is not defined in the SolarWinds Hybrid Cloud Observability (HCO) application mapping database. Flows from unsupported devices or flow direction do not cause unclassified application traffic—rather, they will not be collected or will be marked as unknown flows. "

Thus, unclassified traffic can result from new or custom applications or changes in port usage that are not reflected in the configuration.

Resolving and storing hostnames at the time a flow record is received means the platform does not need to resolve the hostname each time a report or widget is loaded, which:

Decreases database query times: Hostnames are already resolved, making queries for reports and dashboards much faster.

Flow views and widgets load faster: With DNS already resolved, the interface does not have to perform on-demand DNS lookups, reducing latency in the web console.

The SolarWinds documentation states:

" Immediate DNS resolution upon flow record ingestion reduces lookup delays during analysis and widget loading, resulting in improved performance and reduced query times. "

Domain widgets and reports run with DNS names, but the core advantage is performance rather than widget availability.

The SolarWinds platform uses the concept of " dependencies " to handle parent-child relationships. When you configure dependencies (via Manage Dependencies), child objects such as interfaces will show as " unreachable " if the parent node is " down " or unresponsive, rather than " down " or " unknown " .

" The Manage Dependencies feature allows administrators to specify parent-child relationships. If a parent device is down, all child objects will be marked as ' unreachable ' , preventing unnecessary alerts and false positives. "

This is a best practice to avoid alert storms and to properly reflect network hierarchy.

A. A different port is being used: If MSSQL traffic is sent on a port different from the default (1433), SolarWinds may not classify it as MSSQL unless custom mapping is defined.

C. The source or the destination port field is not present: Application mapping relies on port information; missing fields prevent classification.

The documentation states:

" Unclassified traffic may result when known applications use non-default ports or when flow records lack required port information for mapping. "

The radial gauge display in the SolarWinds web console requires that the polled value from the OID is a numeric type that supports gauge visualizations (for example, a percentage or value with a defined minimum and maximum). If the OID returns data that does not fit these requirements—such as text, status, or a counter with no clear min/max—the gauge option will be grayed out and unavailable for selection. This behavior is explained in the Universal Device Poller documentation, which states that only compatible numeric OID types can be displayed using radial gauge resources.

Show best is the status rollup mode designed for groups of redundant or backup devices. It displays the " best " (most available/least severe) status within the group, which is most useful when any one device in the group being up means the group is healthy.

The standard unit for flow-based alerts in SolarWinds (e.g., NetFlow Traffic Analyzer) is megabits per second (mbps). Alerts regarding traffic rates, bandwidth utilization, and similar flow metrics are configured and displayed in mbps for consistency with network monitoring best practices.

When the SNMP community string is changed on a device, SolarWinds recommends:

Edit the node properties and save the changes.

Update the community string in node properties to match the new value on the device.

" To restore polling, edit the node in SolarWinds, update the SNMP community string in the properties, and save the changes. This ensures that SolarWinds can authenticate and resume polling. Deleting and re-adding the node is not necessary, nor is restarting the SNMP service on the device in most cases. "

The Universal Device Poller (UnDP) in SolarWinds allows you to create custom SNMP pollers. Results from UnDPs can be displayed as charts, gauges, or tables on SolarWinds web console views. The administrator guide states:

“Universal Device Pollers (UnDPs) allow you to collect SNMP data not provided natively by SolarWinds. The collected results can be displayed as charts, gauges, or tables, making it easier to visualize the custom metrics.”

Device Studio pollers are templates used to define UnDPs, but it is the UnDP that presents data visually. Hardware health and Network Insight are not custom pollers.

SolarWinds Hybrid Cloud Observability (HCO) supports capturing flow data and CBQoS data using:

A. IPFIX: (IP Flow Information Export) is the IETF standard for exporting flow information, supported for both flow data and CBQoS.

C. NetFlow: Developed by Cisco, widely used for flow and CBQoS data collection.

J-Flow is primarily for flow data (from Juniper devices), and SNMP is not a flow export protocol.

The documentation states:

" NetFlow (including NetFlow v9) and IPFIX are supported for flow and CBQoS data collection. These standards provide extensive network traffic and QoS visibility within HCO. "

SolarWinds NTA (and Hybrid Cloud Observability) supports a range of flow technologies including J-Flow (used by Juniper devices) and sFlow (an industry standard for network monitoring and traffic analysis). GFlow and HFlow are not supported flow technologies in SolarWinds ' official documentation.