Domain 1 Answer Key

The correct answer is B) Enterprise Agent because it:

• Meets all requirements, especially collecting the path from the internal network to the cloud provider
• Can be installed on access switches, as implicitly asked in the question

Incorrect answers:

• A) This answer is a distractor, as all ThousandEyes agents are synthetic agents
• C) Would not provide insights from the internal network
• D) Good for internal network insights but cannot be installed on access switches

The correct answer is D) Cloud Agent because:

• They are pre-deployed by ThousandEyes and immediately available
• They provide diverse geographical perspectives without requiring infrastructure ownership
• There are 200+ observation points worldwide

Incorrect answers:

• A) This answer is a distractor, as all ThousandEyes agents are synthetic agents
• B) This answer choice could be a distractor if the reader misinterprets the data center as the observation point rather than the target
• C) Would need to be installed on machines where customers are connecting, which is a less practical solution for this scenario

The correct answer is D) Endpoint Agent because:

• It is directly installed on the user’s workstation which provides individual insights on any problem the web application and SaaS platforms may experience

Incorrect answers:

• A) This answer is a distractor, as all ThousandEyes agents are synthetic agents
• B) Cannot be deployed to the user’s machine
• C) You can’t select the location of the agent, as they are pre-deployed, making it difficult to use for a specific user location to measure end-user experience.

The correct answer is A) Install an agent on the overlay network because:

• It proactively measures and monitors SD-WAN performance and routing policy validation which is the overlay

Incorrect answers:

• B) Installing an agent on the DMZ does not guarantee being able to run tests on the Overlay network
• C) The LAN is the wrong location as this is an internal network, not part of the SD-WAN tunnel
• D) This is if you want to gain hop-by-hop visibility into the network underlay, not measure SD-WAN

This question tests the understanding of various agent types and their deployment methods in the context of monitoring VPN-connected users.

Correct Answers:

• C) Deploying Enterprise Agents on the VPN concentrator provides visibility into the VPN tunnel itself. This helps identify if issues stem from the VPN infrastructure or beyond.
• D) Deploying Endpoint Agents on employee machines offers a true representation of the end-user experience, encompassing everything from the user's device, home network, and the VPN connection to the application.

Incorrect Answers:

• A) While helpful for general internet performance insights, Cloud Agents won't have visibility into the VPN tunnel.
• B) AppDynamics focuses on application performance monitoring (APM), providing server-side insights. While valuable, it doesn't replace network-level monitoring for VPN users.
• E) Data center-based tests lack visibility into the remote employee's network path, including the VPN connection.

The correct answer is C) Sending a continuous ping from one office to another to measure latency because it generates and injects synthetic traffic into the network to directly measure performance metrics such as latency, allowing for proactive testing of network performance.

Incorrect Answers:

• A) Analyzing SNMP data is passive monitoring
• B) Capturing packets is passive monitoring
• D) Collecting NetFlow records is passive monitoring

The correct answer is B) Passive monitoring can provide real-time data on network performance without adding traffic to the network because it highlights a key advantage of passive monitoring, which is the ability to monitor the network using actual traffic without introducing additional load or overhead

Incorrect answers:

• A) This is an active monitoring technique, as this will generate synthetic traffic and can potentially add load to the network
• C) Passive monitoring allows for the generation of test traffic to simulate user behavior: This is an active monitoring technique, as this will generate synthetic traffic and can potentially add load to the network
• D) This is an active monitoring technique, as this will generate synthetic traffic and can potentially add load to the network

By considering past network conditions and the specific performance needs of voice traffic (defined by SLAs), WAN Insights can recommend alternative paths that are better equipped to handle the load and maintain call quality, even during peak hours. This allows administrators to proactively address congestion before it significantly impacts users.

WAN Insights requires two primary data sources: historical performance metrics from vAnalytics (like loss, latency, and jitter) and application traffic flow data categorized by vManage application lists. This data allows WAN Insights to understand past network conditions and how different applications are performing on various paths.

The correct answer is C) Enterprise Agent because Enterprise Agents are deployed within the Cisco SD-WAN devices to provide detailed network performance data and insights, which can be managed through the vManage console.

Incorrect answers:

• A) Cloud Agents live on the ThousandEyes managed infrastructure
• B) ThousandEyes has a browser extension but is not considered an agent and is used to monitor user browser sessions from the Endpoint Agent
• D) Endpoint Agents cannot be deployed to Cisco SD-WAN devices

The correct answer is B) To monitor external applications and services from SD-WAN sites because the integration of ThousandEyes with Meraki enables distributed organizations to effectively monitor external applications and services from their SD-WAN sites.

Incorrect answers:

• A) This is not a supported deployment type for the Meraki integration
• C) Monitoring services and applications can be viewed as a means to meet security and compliance standards
• D) The primary function is to monitor the remote employee connecting through these branches, enforcing access policies is outside the scope of the Meraki-ThousandEyes integration

The correct answer is C) Network performance data from the user's device because when integrated with Cisco Secure Client, ThousandEyes collects network performance data directly from the user's device to monitor and diagnose issues related to remote connectivity, including VPN performance.

Incorrect answers:

• A) While network hardware configurations are important, ThousandEyes primarily focuses on network performance metrics rather than hardware configuration details.
• B) ThousandEyes is a network intelligence platform that monitors network performance. It does not focus on user activity and behavior which would be more relevant to user monitoring.
• D) ThousandEyes doesn't user data related to secure web gateway performance when integrated with Cisco Secure Client.

The correct answer is D) It allows for quick identification and resolution of performance issues. because the integration of ThousandEyes with Cisco technologies provides comprehensive monitoring and visibility into network performance, enabling IT teams to quickly identify and troubleshoot issues.

Incorrect answers:

• A) While ThousandEyes can complement network management by providing visibility into network performance, it is not specifically a network management tool for configuring and managing Cisco routers and switches.
• B) ThousandEyes does provide visibility into networks within and outside the network engineer's control which helps identify security attacks such as DDoS, BGP Hijacks and Route Leaks quickly but it does not automate the prevention of such attacks.
• C) While automation may be a feature of some Cisco technologies, the integration of ThousandEyes itself does not automate network configuration changes base don user feedback.

The correct answer is B) Network Path because this network visualization pane displays what is known as path visualization in ThousandEyes, where the hop-by-hop network nodes from the device to the Webex server are shown.

Incorrect answers:

• A) In this section you can add or manage all the devices for your organization that are assigned to a user or part of a place.
• C) This is the section for user management.
• D) In this section you can configure and customize organization-wide settings for Webex.

The correct answer is C) SNMP data collected from the routers because SNMP is specifically designed for collecting device-level metrics like CPU utilization, memory usage, and interface statistics.

Incorrect answers:

• A) DNS resolution is an unrelated metric to device performance.
• B) HTTP is an unrelated metric to device performance.
• D) Path visualization is a graphical representation of the traces sent from the agent to the destination.

The correct answer is C) Capturing both peak and off-peak traffic patterns for a representative view because it's essential to capture the full spectrum of network behavior, including both peak and off-peak traffic patterns. This provides a more accurate and representative understanding of how the interface is utilized under different load conditions.

Incorrect answers:

• A) Choosing a time period with the lowest network traffic volume would not provide a representative baseline for interface utilization. It is important to capture data that reflects normal operating conditions, including both high and low traffic periods.
• B) Taking only the organization's financial year would not be an accurate representation to establishing a baseline for network interface utilization. The focus should be on capturing typical network usage patterns rather than aligning with financial cycles.
• D)While it may be convenient to limit the amount of data for analysis, doing so could result in an incomplete or skewed baseline that does not accurately reflect the network link's utilization. It is important to collect enough data over a sufficient time period to ensure the baseline is representative of actual usage.

The correct answer is A) ServiceNow Integration because it is the only built-in option available.

Important note:

While option C) Custom Webhooks is another route to create alerts if ITSM is not already available as a built-in option, but the scenario does not mention that the ITSM is not available, making this the second-best choice.

The correct answer is B) OpenTelemetry because:

• OpenTelemetry is used for streaming metrics from tests in real-time to an observability platform. These streams can be processed to create helpful graphs, charts, tables, or other visualizations.

Incorrect answers:

• A) While the API is extremely flexible and can give data to be presented in any method you see fit, it is not streamed in real-time. The API is queried only as frequently as it is configured to be called.
• C) The DNA Center Integration leverages the ThousandEyes API to present relevant data to be displayed within the DNA Center interface.
• D) Alert Thresholds are used to send alert notifications when their conditions are met. While these notifications are sent shortly after the alert thresholds are reached, they are not a real-time stream of the data produced by the tests.

The correct answer are A) ServiceNow, B) PagerDuty, E) AWS, F) AppDynamics, and H) Slack

Incorrect answers:

• C) MS Teams: Supported through custom webhooks, but not natively integrated at the time of writing
• D) Splunk: Alert notifications are possible via email A separate Splunk integration exists for data collection with OTEL, but not for alerts
• G) Webex: While a Webex Control Hub integration exists, it doesn't support alert notifications

The correct answer is C) ThousandEyes because:

• ThousandEyes provides Internet/ISP path visibility to applications and services wherever they are hosted. Endpoint Agents cover hybrid workers, while Enterprise Agents cover branch offices and cloud services.

Incorrect answers:

• A) Provides valuable insights for Meraki networks but may not comprehensively cover hybrid workers, internet traffic, and branch offices if different hardware/vendors are used.
• B) Focuses on application performance monitoring, not network assurance
• D) An on-premises solution, not SaaS-based

The correct answer is D) ThousandEyes because:

• ThousandEyes Endpoint Agents can monitor the user experience from the remote worker’s device, providing metrics on WiFi, VPN, and system performance.
• Tests can measure network and application metrics from the endpoint across the internet to the SaaS provider, giving end-to-end visibility.

Incorrect answers:

• A) Focuses on managing on-premises Cisco networks and lacks the SaaS and internet visibility needed here.
• B) Is application-centric and would require integration with ThousandEyes for the network visibility aspects.
• C) Is valuable for Meraki-based networks but may not cover the end-to-end visibility from the remote endpoint to the SaaS provider if other network components are involved.

The correct answer is D) ThousandEyes because it's a network intelligence platform specifically designed for comprehensive network visibility. It monitors any network and correlates network metrics with application performance, making it ideal for campus networks and multi-cloud deployments.

Incorrect answers:

• A) Catalyst Center: Focuses on network management and automation, not network performance visibility
• B) AppDynamics: Primarily an application performance management (APM) tool. While it offers some network visibility, it's not its core strength
• C) Meraki Insights: Provides network insights but is often tied to Meraki hardware and may not be as comprehensive as ThousandEyes, especially in multi-cloud environments