Turn interface counters into a safe incident response
A hands-on N10-009 lab. You produce the real artefact and 10 automated checks verify it behaves the way the exam expects.
Try this labAll N10-009 practice
- Certification
- N10-009
- Format
- Structured configuration
- Difficulty
- hard
- Estimated time
- 40 min
- Automated checks
- 10
The brief
Edit monitoring-plan.json with exactly collectors, rules and interventions. Collectors is a list of at most eight records with interface, octetSource (ifHCOutOctets or ifOutOctets) and discontinuityPolicy (discard or ignore). Configure exactly wan, access and backup. Rules is a list of at most 16 records with id, interfaces, conditions, sustainSamples and clearSamples. Interfaces is a nonempty list of distinct known names. Conditions is a nonempty list of up to three records with metric (egressPercent, errorsPerSecond or latencyMs), mode (absolute or baseline-multiple) and positive numeric threshold. Metrics must be distinct. A multiple uses that interface's healthy baseline; every condition must be strictly greater than its threshold. SustainSamples and clearSamples are integers 1..4 counting consecutive observations. Any unknown required metric resets both counts and preserves an active alarm. Require at least two valid nonviolating observations for closure. Interventions is a list of at most eight records with id, operation, afterRule and integer startSeconds 0..540. Ids are unique trimmed strings of 1..80 characters within each list. Use one catalog operation per faulty interface and none on backup; afterRule must monitor that same interface and show an active violating observation at or after 240 before the operation starts. Durations and effects are fixed. Finish deadlines, crew capacity, service limits and confirmed closure must all hold. Counter deltas must be unique under their physical bounds, and healthy observations must raise no alarm. Run tests, read the interval, alarm time and finish-time evidence, and repair the saved artifact without Reset.
What the checks verify
Your work is graded on 10 independent properties, not on matching one reference answer.
- The monitoring artifact uses exact bounded collector, conjunctive alarm and intervention records.
- Every interface has exactly one collector and all rule scopes and intervention references resolve.
- Selected counter deltas have one physically possible increment and discard epoch discontinuities.
- Each incident has an alarm covering its declared diagnostic signature.
- Every required incident has an active violating observation by its detection deadline.
- Neither healthy controls nor pre-incident observations activate an alarm.
- Exactly one intervention per faulty interface follows its qualifying alarm, fits crew capacity and finishes on time.
- The sum of declared intervention outage impacts fits the 75-second budget.
- Forecast service metrics at the replay horizon satisfy each incident's healthy limits.
- Incident alarms activate and then clear after at least two valid nonviolating observations; none remains active.
Where this sits in the N10-009 blueprint
- Domain
- Network Operations
- Objective
- Network Monitoring
- Skill
- Telemetry and Baselines
Part of N10-009 preparation
Labs are written by ExamNova to teach the decisions the exam tests. They are not reproductions of vendor lab content.