810-01 Practice Questions

The Response Time Composition Chart in AppResponse displays average performance metrics for the selected traffic group. When applied to a broad, heterogeneous group like "All Traffic," performance data from numerous different applications, clients, and servers is aggregated and averaged. This statistical averaging masks the true performance of individual components. Consequently, high-latency events or poorly performing applications (performance anomalies) are obscured or "smoothed out" by the large volume of normal, low-latency traffic. This makes the chart misleading for troubleshooting, as the root cause of a specific issue cannot be isolated. Effective analysis requires using the chart on narrowly defined, specific application groups.

D. The chart is a core feature of Application Stream Analysis (ASA) and applies to any defined TCP-based application group, not exclusively to Web Transaction Analysis (WTA) traffic.

E. This chart is a high-level dashboard component for initial analysis. Packet Analyzer Plus is a separate tool for deep-dive packet inspection, typically used after a problem is identified.

1. Riverbed AppResponse 11.12 User's Guide, Chapter 4: Application Stream Analysis, Section: "Application Stream Analysis Dashboards," Page 101.

This section describes the "Response Time" widget (the composition chart), stating it "Shows the average response time for the selected application..." This confirms that the chart uses averages, which is the basis for the problems described in options A, B, and C. The section also places this chart within the general Application Stream Analysis (ASA) functionality, refuting the claim in option D that it is only for WTA.

2. Riverbed AppResponse 11.12 User's Guide, Chapter 4: Application Stream Analysis, Section: "Application Stream Analysis Workflow," Page 100.

This section outlines the intended workflow, which starts with high-level dashboards and then allows for "drill down to see more detailed information" or to "launch Packet Analysis for deep packet-level analysis." This refutes the claim in option E that using Packet Analyzer is a prerequisite.

3. Jain, R. (1991). The Art of Computer Systems Performance Analysis. John Wiley & Sons. Chapter 10: "The Art of Data Presentation."

This foundational academic text on performance analysis explains that while summary statistics like averages are useful, they can also hide significant details. Section 10.2 warns that "the first thing you should determine is whether the variability is small or large. If it is large, the mean and variance may not be sufficient." Applying a single average to a large, diverse group like "All Traffic" is a classic example of improperly representing a system with high variability, which supports the reasoning in options A, B, and C.

NetProfiler's Service Monitoring feature is designed to provide a business-centric view of IT performance. It allows administrators to define a "business service" by grouping together multiple related applications and network components. This aggregates their individual performance metrics into a single, consolidated dashboard for the service. This contextualizes raw network and application data, making it easier to understand the performance and availability of critical business functions, rather than just monitoring isolated IT elements.

B. Define general applications by IP addresses and ports: This describes Application Definitions, which is a foundational step but distinct from Service Monitoring, which groups these applications into a higher-level service.

C. Manage application definitions on synced AppResponse appliances: While NetProfiler can integrate with AppResponse, the Service Monitoring feature itself is for performance aggregation and contextualization, not for managing configurations on other appliances.

D. Enable automatic baselines on specific interfaces or interface groups: Automatic baselining is a separate, powerful feature in NetProfiler that learns normal behavior for various metrics, but it is not configured through Service Monitoring definitions.

1. Riverbed NetProfiler User's Guide: In the "Service Monitoring" chapter, the guide states, "Service Monitoring provides a business-centric view of your network and application performance... You can define business services and monitor the performance of the applications that comprise each service." This directly supports the concept of grouping metrics in the context of business services. (Reference: Riverbed NetProfiler 10.17.x User's Guide, Chapter 11: "Service Monitoring," Page 215).

2. Riverbed SteelCentral NetProfiler Product Brief: This document describes the feature by stating, "Define business services and create service-level dashboards to monitor the performance of the applications that comprise each service." This aligns perfectly with grouping and monitoring in a business context. (Reference: Riverbed SteelCentral NetProfiler Product Brief, "Business-Centric Service Monitoring" section).

Grouping in SteelCentral Portal is a foundational feature for organizing and analyzing performance data. It allows administrators to combine multiple, related configuration items (such as servers, applications, or network devices) into a single logical entity. This grouping facilitates the aggregation of performance metrics (A), enables the display of this combined data in a single dashboard widget or report visualization (B), and supports the creation of nested, parent-child hierarchies for data roll-ups and drill-downs (C). Because all listed statements accurately describe core functionalities of element grouping within the platform, "All of the above" is the most comprehensive and correct answer.

A. Allows aggregation of multiple elements: This statement is true, but it is not the only function of grouping. It is an incomplete answer.

B. Displays multiple elements in a single visualization: This is also a true statement and a primary benefit of grouping, but it is not the sole purpose.

C. Creates a parent-child hierarchy using roll ups: This is another true statement describing the advanced capability of nested groups, but it does not cover all aspects.

1. Riverbed SteelCentral Portal 20.2 User's Guide, Chapter 5: "Working with Groups," Page 101. The guide states, "Groups enable you to aggregate data from multiple sources and view them as a single entity." This directly supports options A and B.

2. Riverbed SteelCentral Portal 20.2 User's Guide, Chapter 5: "Working with Groups," Page 101. The documentation also explains, "You can create groups of groups to form a hierarchy, allowing you to roll up data for high-level views." This directly supports option C.

The Riverbed Portal prioritizes data sources to provide the most accurate representation of the end-user's experience. AppInternals JavaScript provides Real User Monitoring (RUM) data by capturing metrics directly from the end-user's browser. This is the most direct and highest-fidelity source for metrics like page load times and browser rendering performance. Therefore, when data from the AppInternals JavaScript agent is available for an application model, Portal gives it the highest priority for populating the End-User Experience Dashboard over network-inferred sources.

A. AppResponse ASA: Application Stream Analysis (ASA) provides valuable network and server delay metrics but infers performance from network packets, making it less direct than browser-based RUM.

B. NetIM SNMP Polling: NetIM provides infrastructure health metrics (e.g., CPU, memory) via SNMP. This data offers context but does not directly measure the application experience from the user's perspective.

D. AppResponse WTA: Web Transaction Analysis (WTA) reconstructs user web sessions from network traffic. While an excellent source for EUE, it is still network-based and considered secondary to direct measurement from the user's browser.

1. Riverbed Portal User's Guide: In the section describing Application Models and data sources, the documentation specifies the order of precedence for populating metrics. It states that for end-user experience metrics, data from AppInternals (specifically the JavaScript agent for RUM) is prioritized over data from AppResponse WTA, which is in turn prioritized over AppResponse ASA.

Reference: Riverbed Portal 4.7 User's Guide, "Application Models" chapter, section on "Data source precedence for application models," page 45. The guide explicitly lists the priority as: 1. AppInternals, 2. AppResponse WTA, 3. AppResponse ASA.

2. Riverbed NPM and APM Solution Guide: This official vendor documentation outlines the roles of different products. It describes AppInternals as the solution for deep application diagnostics and real user monitoring, positioning its data as the primary source for user-centric performance analysis within the integrated suite.

Reference: Riverbed Application Performance Management (APM) Solution Brief, section on "End-user experience monitoring," which details the function of the JavaScript agent in capturing client-side metrics.

Riverbed AppResponse is designed to provide high-fidelity performance data. For its Standard Groups, which rely on pre-computed aggregates, the system collects and summarizes performance statistics at a base interval of one minute. This is the highest level of granularity available for historical reporting and analysis. All longer-term reporting intervals (e.g., 5-minute, 1-hour) are created by "rolling up" or further aggregating these foundational one-minute data points. Therefore, the minimum possible reporting interval is one minute.

B. 5 minutes: This is a common, but not the minimum, aggregation interval. It is typically a roll-up of five 1-minute data points.

C. 1 hour: This is a long-term aggregation level used for trend analysis over extended periods, far from the minimum available granularity.

D. 6 hours: This represents a very high-level data aggregation, used for capacity planning or long-range historical views, not for detailed analysis.

1. Riverbed AppResponse 11.13.0 User's Guide: In the chapter "Working with Insights," the section "Creating an insight" describes the "Granularity" setting for charts and reports. The documentation and user interface show that the finest available granularity for viewing aggregated data is "1 minute." This reflects the base interval at which statistics are pre-computed. (Reference: Chapter 5, "Working with Insights").

2. Riverbed AppResponse 11 Concepts Guide: The guide explains the data aggregation model, stating that performance metrics are initially stored at the highest resolution (1-minute intervals) and are subsequently rolled up into coarser granularities (5-minute, 1-hour, etc.) over time to manage storage. This confirms that the foundational, minimum interval is one minute. (Reference: Chapter on "Data Collection and Storage").

In Riverbed AppResponse, an "Advanced Group" is a user-defined logical entity used to classify and monitor traffic for a specific application, site, or set of servers. AppResponse processes the raw packets matching the group's criteria to extract detailed, structured performance metrics for individual application interactions. This processed information is known as transactional data, which includes metrics like response times for web page views, database queries, or file transfers. This granular, transaction-level data is the foundation for deep-dive performance analysis and troubleshooting within AppResponse.

A. Preferred IP addresses: IP addresses are used as criteria to define which traffic belongs to a group; they are not the performance data collected for that group.

C. Raw Packets: Raw packets are the source from which data is derived, but the "Advanced Group data" itself consists of the analyzed and structured performance metrics, not the raw packet capture.

D. Aggregated and Summarized Information: While AppResponse does create aggregated summaries, this information is derived from the more fundamental transactional data. Transactional data is the primary, detailed information that best describes the group's data.

1. Riverbed AppResponse 11.13 User's Guide, "Application Discovery and Definition" chapter, Section: "Defining Applications with Groups." This section details how groups are configured using criteria like IP addresses and ports to classify traffic. The purpose of this classification is to enable specific monitoring.

2. Riverbed AppResponse 11.13 User's Guide, "Analyzing Application Performance" chapter, Section: "Web Response Time Composition Chart." This section illustrates the output of AppResponse analysis, showing detailed breakdowns of individual web transactions. It states, "The Web Response Time Composition chart shows how the total time for a web transaction is divided among various sources of delay," confirming the focus on transactional data.

3. Riverbed AppResponse 11.13 User's Guide, "Analyzing Application Performance" chapter, Section: "Viewing Insights for an Application." This section describes the various metrics available for a defined application (group), such as "Total Transactions," "Slow Transactions," and "Errors," which are all counts and classifications based on individual transaction analysis.

The most effective starting point for downstream discovery in Riverbed Portal is the front-end hosts or their IP addresses. Application performance monitoring and modeling aim to trace the path of a user transaction from its origin. This journey begins when a user request hits a front-end component, such as a web server or a load balancer's virtual IP (VIP). By defining these front-end entities first, the discovery process can naturally follow the traffic flow "downstream" through the application servers, middleware, and ultimately to the back-end databases, creating a complete and accurate model of the entire service delivery chain.

A. Back-end DBs: Databases are at the end of a typical transaction path. Starting discovery here would be an "upstream" process, which is less effective for modeling the user-facing application structure.

C. Application Servers: While a critical component, the application server is a middle tier. Starting discovery here would fail to include the front-end web servers or load balancers that users initially interact with.

D. 3rd Party Services: These are external dependencies. They are typically discovered as a result of traffic leaving the core application, not used as the starting point for discovering the application itself.

1. Riverbed SteelCentral Portal User's Guide: In the sections covering Application Discovery and Configuration, the process typically begins by defining an application based on the servers that host it. The guide emphasizes identifying the client-facing (front-end) servers to allow the system to automatically map dependencies by analyzing traffic flows. For instance, the configuration workflow for a new application model prompts the user to add servers, and the logical first step is to add the servers that receive initial client requests. (Reference: SteelCentral Portal User's Guide, specific versions may vary, but the "Application Definitions" or "Application Discovery" chapter consistently outlines this front-end-first approach).

2. Riverbed SteelCentral AppResponse Documentation: When defining applications for analysis in AppResponse, which feeds data into Portal, the configuration is based on identifying the servers and ports that constitute the application. The primary method involves specifying the front-end server IP addresses that receive client traffic, which then allows the system to trace and discover the back-end tiers they communicate with. (Reference: SteelCentral AppResponse User's Guide, section on "Configuring Applications").

The "Analytics" feature, typically accessed via a right-click context menu on an element within the Riverbed Portal UI, is specifically designed for this purpose. When an element such as a host, application, or conversation is selected, the Analytics menu presents a list of available reports and views. Selecting an option from this menu allows the user to pivot their analysis and view different, correlated metrics for that specific element, such as seeing top talkers for an application or performance metrics for a specific host. This provides a powerful, context-sensitive way to investigate issues by exploring related data sets.

A. Drill Down: This action typically refines the current report by adding a filter for the selected item, showing more detail within the same metric context, rather than showing different correlated metrics.

B. Launch: This option is generally used to open an external, integrated tool (like Packet Analyzer) or a separate, predefined workflow, not to display correlated metrics within the Portal UI itself.

C. Display in Graph: This is a visualization function that renders already selected data in a graphical format. It does not, by itself, provide the means to select or discover other correlated metrics.

1. Riverbed SteelCentral NetProfiler and Flow Gateway User's Guide, Version 10.9.2, "Interactive Reports," page 46: "The Analytics menu displays a list of reports that you can run on the selected item. For example, if you select a host group, you can run a Host report on that group." This directly supports that "Analytics" is used to show other metrics (reports) for a selected element.

2. Riverbed SteelCentral NetProfiler and Flow Gateway User's Guide, Version 10.9.2, "Interactive Reports," page 46: "The Drill Down menu adds a filter to the current report to show more detail." This confirms that Drill Down is for filtering the current view, not for correlation.

3. Riverbed SteelCentral NetProfiler and Flow Gateway User's Guide, Version 10.9.2, "Interactive Reports," page 46: "The Launch menu enables you to launch other Riverbed applications, such as Packet Analyzer..." This clarifies the purpose of the "Launch" feature as tool integration.

The 'Traffic in Context' feature in NetProfiler is a powerful drill-down tool designed to maintain the analytical context when pivoting from one report to another. When a user generates a new report using this feature, NetProfiler preserves the complete context of the original report. This includes both the specific time frame being analyzed and all previously applied traffic criteria or filters (e.g., hosts, applications, conversations). This functionality enables a seamless and focused investigation of a specific traffic pattern or performance issue without requiring the user to manually re-apply the same parameters for each new analytical view.

B. Only the traffic criteria: This is incorrect because the time frame is a fundamental part of the analytical context and is also carried forward.

C. Only the time frame: This is incorrect because the specific traffic filters are essential for the drill-down analysis and are also preserved.

D. No data is carried forward: This is incorrect as the core purpose of the 'Traffic in Context' feature is to carry forward the existing analytical context.

1. Riverbed SteelCentral NetProfiler 10.9.2 User's Guide: In the section "Reports," under the subsection "Drilling Down with Traffic in Context," the documentation states: "When you launch a new report using Traffic in Context, the new report inherits the time controls and any filters from the original report. The item you selected in the original report is added as a new filter." (This concept is detailed in the reporting and analysis chapters of the official user guides).

2. Riverbed Official Courseware, RSP 220-A: Riverbed SteelCentral NetProfiler & NetExpress Essentials: Module 6, "Reporting and Analysis," explains that context-based drill-down reporting maintains the time interval and filters from the parent report to provide a consistent and focused troubleshooting workflow. The 'Traffic in Context' menu is presented as the primary mechanism for this action.

Point tools are specialized for monitoring individual IT domains like networks, applications, or infrastructure. Digital Experience Management (DEM) requires a holistic, end-to-end view of the entire service delivery chain as perceived by the end-user. The primary ineffectiveness of point tools is that they operate in silos. When troubleshooting a user experience issue, this siloed data creates "tunnel vision," where each IT team can only see their specific component. This prevents effective correlation of data across domains, leading to finger-pointing and significantly longer resolution times, as the true root cause often lies in the interactions between components.

B. Don't allow domain-specific analysis: This is incorrect. Point tools are, by definition, designed for deep, domain-specific analysis (e.g., a network analyzer for network analysis).

C. Insufficient data granularity: This is not the fundamental issue. Many point tools provide extremely granular data for their specific domain; the problem is the lack of a unified view across different domains.

D. Produce metric data sets that are too large to parse quickly: While data volume can be a challenge, the core problem is the lack of context and correlation between disparate data sets, not the volume itself.

1. Riverbed Official Documentation: The "Alluvio Unified Observability Platform Solution Brief" explicitly addresses this limitation. It states, "Siloed monitoring tools result in visibility gaps, data conflicts, and wasted time trying to manually correlate data during 'war rooms.' This prevents IT from having a shared, single source of truth to quickly and accurately diagnose problems..." This directly supports the "tunnel vision" and separate component monitoring described in option A.

Source: Riverbed, "Alluvio Unified Observability Platform Solution Brief," Page 2, "The Problem: Tool Sprawl and Data Silos."

2. Riverbed Official Documentation: The concept of unified observability is positioned as the solution to the problem of point tools. The documentation emphasizes collecting data from all sources into a single platform to provide context. It highlights that without this unification, "IT teams are left to manually sift through massive and disparate data sets to find the needle in the haystack." This reinforces that the core issue is the separation of data, not its granularity or volume.

Source: Riverbed, "What is Unified Observability?" (Official Web Resource), Section: "Why is Unified Observability Important?".