Observability-Self-Hosted-Fundamentals SolarWinds Observability Self-Hosted Fundamentals Free Practice Exam Questions (2026 Updated)

Platform Connectis a foundational technology in Hybrid Cloud Observability (HCO) that bridges the gap between the on-premises (self-hosted) installation and SolarWinds' cloud-based AIOps and machine learning services. According to theSolarWinds HCO Administrator Guide, the primary function enabled by this connection isanomaly-based alerting.

Anomaly detection requires significant computational resources to process months of historical performance data and build sophisticated behavioral baselines for thousands of metrics. To prevent this heavy processing from impacting the performance of the local monitoring server, SolarWinds offloads the analysis to a cloud-based machine learning engine.Platform Connectprovides the secure, encrypted tunnel required to transmit relevant performance metadata to the cloud for analysis and receive dynamic threshold updates in return.

Without Platform Connect, the local instance is restricted to traditional static thresholds (e.g., "Alert if CPU > 90%"). With it, the system can identify "unusual" behavior (e.g., "Alert if CPU is 70% at 2:00 AM on a Tuesday, when it is normally 10%"). While HCO handles infrastructure monitoring and mapping locally, the specific "intelligence" layer that drives anomaly detection is the standout benefit provided by the Platform Connect architecture.

Groups in the SolarWinds Platform are logical containers used to organize monitored entities for easier management, alerting, and reporting. According to theSolarWinds Platform Administrator Guide, one of the most powerful features of the grouping engine is the ability to automate membership. Specifically,groups can be created based on custom properties.

When defining a group, administrators can choose between "Static Selection" (manual) or "Dynamic Query." By using dynamic queries, a group can be configured to automatically include any node, interface, or volume that matches specific criteria, such as a custom property value (e.g., Department = Engineering or Site = London). This ensures that as new infrastructure is added to the environment and tagged with the appropriate metadata, the groups update themselves without human intervention.

Regarding the other options: groupscanbe members of other groups (nested groups), which is a common practice for creating complex hierarchical views of an organization. The default status rollup mode is typically set to "Mixed" or "Show Worst Status" rather than "Best Status," to ensure that any single failure within the group is visible to the administrator. Finally, rollup options absolutely apply to all members within the group, as they define how the collective health of those members is calculated and displayed on the dashboard.

Custom properties can be configured as "Mandatory" to ensure data integrity across the platform. According to theSolarWinds Platform Administrator Guide, changing a property like AssetTag to mandatory after nodes already exist creates an enforcement requirement.

The system does not retroactively block polling or delete nodes (Option B and D are incorrect), but it enforces the requirement during administrative interaction. Specifically:

Requirement after the action (A): Moving forward, any new node added to the system will require the AssetTag field to be populated before the node can be saved.

Requirement when edited (C): For existing nodes that do not yet have an AssetTag, the platform will permit them to exist and be polled normally. However, the next time an administrator attempts toeditthe properties of that node, the Web Console will block the "Save" action until a value is provided for the mandatory AssetTag field. This ensures that as the environment is managed over time, the metadata is gradually backfilled until all mandatory requirements are satisfied.

AppStackis designed to provide a "top-to-bottom" visual representation of the IT infrastructure layers that support an application. According to theSolarWinds Platform Administrator Guide, the AppStack Environment view automatically maps relationships between specific monitored entities.

The two primary categories that appear in this view aredatabase instances (A)andservers (C). In a typical application stack, the "Server" represents the physical or virtual hardware, while the "Database Instance" (monitored via AppInsight for SQL, Oracle, etc.) represents the software layer running on that server. AppStack visually links these so that if a database instance shows a critical status, an administrator can instantly see which server it is hosted on and if there are underlying infrastructure issues. Other common categories include Applications, Transactions, Virtual Hosts, Clusters, and Volumes.

NetFlow(Option B) is a traffic analysis technology used in the NetFlow Traffic Analyzer (NTA) and is generally not a primary "entity" category in the standard AppStack environment map.SNMP Pollers(Option D) are the backend mechanisms used to collect data; they are a configuration component rather than a logical infrastructure entity that would be represented as a layer in an application dependency stack.

The alerting engine in the SolarWinds Platform uses a "Scope" and "Condition" logic to determine when an action should fire. According to theSolarWinds Platform Alerting Guide, the "Scope" defineswhichobjects the alert engine should evaluate, while the "Condition" defineswhatperformance metric triggers the alert.

To limit an alert to a specific set of router interfaces, the administrator mustmodify the scope on the trigger conditions. In the Alert Wizard, under the "Trigger Condition" tab, there is a section titled "I want to alert on..." (Interface) and a secondary section for "The scope of the alert". By adding specific rules to this scope—such as Node Name is Router-A or Interface Alias contains WAN—the alert engine will ignore the thousands of other interfaces in the database and only monitor the 75% utilization threshold on those specific targets. Using account limitations (Option D) is incorrect for this purpose, as account limitations affect what ausersees in the console, not how the backendalerting engineprocesses data.

The SolarWinds Alerting Engine provides a wide array of "Trigger Actions" that occur automatically when an alert's conditions are met. According to theSolarWinds Platform Alerting Guide, these actions are designed to either notify a human operator or perform an automated remediation step.

Send an e-mail (D): This is the most common alert action. It allows the system to send formatted notifications (including variables for node name, IP, and status) to individuals, distribution lists, or ticketing systems like ServiceNow or SolarWinds Service Desk.

Execute a script (B): This is the primary tool for automated "self-healing." An alert can be configured to run a local batch file, a PowerShell script, or a VBScript on the SolarWinds server. For example, if a "Service Down" alert triggers, the system can automatically execute a script to attempt to restart that service on the remote node before a human technician even sees the alert.

Options A and C are incorrect because they are not "actions" triggered by the alerting engine.Adding widgets to views(Option A) is a manual customization task performed by an administrator in the web console. While you canschedulea report to be sent via email, the alerting engine itself does notgenerate a report(Option C) as a reactive trigger action to a node failure; reports are intended for historical analysis rather than immediate event response.

Network Discovery in the SolarWinds Platform is designed to identify as much infrastructure as possible, even if that infrastructure is "locked down." According to theSolarWinds Platform Administrator Guide, the discovery wizard follows a specific hierarchy of identification.

If a device hasSNMPorWMIdisabled (often the case for security-hardened servers, basic switches, or simple IP-enabled appliances), the platform cannot gather deep performance metrics like CPU or memory. However, the device can still be discovered and monitored for "Up/Down" availability using a simple Ping (ICMP). To ensure these devices are added to the database during a scan, the administrator must check the box to "Include devices that only respond to ICMP" during the discovery configuration. If this is not selected, the discovery engine will skip any IP address that does not provide a valid SNMP or WMI credential response, potentially leaving gaps in the network inventory. This is the standard method for monitoring "Ping-only" nodes.

In the SolarWinds Platform, report access is governed by both functional permissions and account limitations. While "Disable Manage Reports" (Option B) prevents a user from editing or creating reports, it does not necessarily hide the "Reports" menu or prevent the user from viewing existing reports they have access to. To completely remove the visibility and accessibility of all reports for a specific user account, anAccount Limitationmust be applied.

According to theSolarWinds Platform User Account Managementdocumentation, account limitations act as a security filter that restricts what the user can see throughout the entire Web Console. By navigating toSettings > All Settings > Manage Accounts, selecting the user, andediting theirReport Limitation, an administrator can choose "No Reports". This configuration ensures that when the user logs in, the Reports section will either be empty or completely hidden from their navigation bar, regardless of their other permissions. This is the most effective method for high-security environments or multi-tenant deployments where certain users should have zero visibility into the historical performance data or inventory summaries contained within the reporting engine.

When integrating Active Directory (AD) with the SolarWinds Platform, the system is designed to leverage AD groups for role-based access control (RBAC). According to theSolarWinds Platform Administrator Guide, the platform specifically requiresSecurity Groupsfor authentication and permission mapping.

Active Directory contains two primary group types:Security GroupsandDistribution Groups. Distribution groups are intended purely for email lists and do not have a Security Identifier (SID) that can be used for assigning file system or application permissions. Because SolarWinds relies on the SID to grant web console access and define user rights,distribution groupswill not appear in the search results when attempting to add new Windows groups to the platform. To resolve this, the AD administrator must either convert the existing distribution groups to security groups or create new security groups containing the desired users. Once the group type is set correctly to "Security," the SolarWinds search utility will be able to resolve the group name and SID, allowing it to be imported and assigned permissions within the console.

Custom Views(Summary Views and Detail Views) are the primary way administrators control the layout and focus of the SolarWinds Web Console. According to theSolarWinds Platform Administrator Guide, views are used to tailor the platform to different user roles.

The two primary reasons for creating them are:

Limit user access to specific elements (A): Views can be restricted to specific users or groups. By creating a custom view that only contains "Storage" widgets and assigning it to the Storage Team, an administrator can effectively limit what those users see when they log in. This prevents users from being overwhelmed by irrelevant data and acts as a functional layer of access control.

Personalize user experience and focus on specific elements (D): Different roles require different data. A CXO might need a high-level "Map" and "SLA Trend" view, while a technician needs a "Top 10 Nodes by CPU" and "Active Alerts" view. Custom views allow the administrator to curate exactly which widgets are visible, ensuring that each user has the most relevant information for their job front-and-center.

SQL customizations(Option C) are a method of building widgets, but not thereasonfor the view itself. Monitoring new elements (Option B) is handled through theAdd NodeandPollerssettings; a view onlydisplayswhat is already being monitored.

Managing user permissions through Active Directory (AD) groups in SolarWinds requires an understanding of how the platform resolves conflicting rights. When a user belongs to multiple groups, the platform must determine which set of permissions takes precedence. According to theSolarWinds Platform User Account Managementguide, there are two primary ways to ensure the "correct" (often the most restrictive or most specific) permissions are applied.

Add users as individual users (A): Individual user account settings always take precedence over group settings in the SolarWinds Platform. If a user needs specific rights that differ from their assigned AD groups, creating a local or AD-linked individual account for them allows the administrator to "override" group-level permissions with 100% certainty.

Re-order groups (D): The SolarWinds Web Console allows administrators to change thesearch orderof groups. When a user logs in, the platform checks the groups in the order they are listed in the "Manage Accounts" screen. The first group match it finds is the one that defines the user's session permissions. By re-ordering the groups, an admin can ensure that the group with the "correct" intended permissions is processed first.

Options B and C are inefficient and unnecessary "nuclear" options that disrupt the benefits of using centralized AD management for the rest of the organization.

The SolarWinds Platform web-based report builder provides specific layout options to ensure reports are professional and readable. According to theSolarWinds Platform Reporting Guide, customization of a report's visual structure is handled through the Layout tab.

Logo on the report (B): Administrators can upload a custom company logo to appear in the header of the report. This ensures that exported PDFs and web views align with corporate branding standards.

Width of the report (D): The layout editor allows users to define the report width, typically choosing between a fixed pixel width (often used to ensure a consistent look on printed paper or PDF) or a percentage-based fluid width that adjusts to the browser window.

While the platform allows for some styling, granular control over thefont of the report content(Option A) is generally limited to global CSS or predefined themes rather than individual report layout settings. Similarly, theposition of the page number(Option C) is usually a fixed element of the report's footer template and is not a standard customizable field within the primary web-based report layout wizard.

Visibility of the reporting module is a configurable security setting within each SolarWinds user account. According to theSolarWinds Platform User Account Managementguide, if a user logs into the Web Console and finds the Reports section empty or inaccessible, it is likely due to anAccount Limitation.

Specifically, the "Report Limitation" field in the user's profile can be set to"No Reports". This setting acts as a total block, preventing the user from viewing any report definitions, whether they are predefined (out-of-the-box) or custom-made. This is a common configuration for restricted user roles, such as basic operators or external contractors, who need to see real-time status in dashboards but should not have access to the historical, inventory, or security data contained in the platform's reporting engine. While a user could also be restricted from seeing specific entities (Option B), this would typically just result in empty datainsidea report rather than the total inability to view the reports module itself. Setting the account to "No Reports" ensures the user isprevented from viewing all reportsglobally across the platform.

SolarWinds Hybrid Cloud Observability provides robust reporting capabilities designed for both technical analysis and executive presentation. TheSolarWinds Platform Reporting Guidespecifies that reports generated through the Web Console can be delivered or manually exported in several standardized formats.

Excel (.xls/.xlsx): This format is primarily used for data-heavy reports where administrators need to perform further calculations, sorting, or external data manipulation. It allows the raw table data from the report to be easily ingested into other business intelligence tools.

PDF: This is the standard format for automated delivery and "executive-ready" documentation. It preserves the visual layout, including charts, logos, and specific formatting defined in the report builder.

While the platform usesJSON(Option B) for internal API communications and some dashboard configurations, andtxt(Option D) might be used for certain log exports, they are not standard selectable "export formats" within the primary Web-Based Report builder for end-user consumption. The primary focus of the reporting engine is providing human-readable (PDF) and spreadsheet-compatible (Excel) outputs.

SolarWinds agents support two communication modes: "Server-Initiated" (Passive) and "Agent-Initiated" (Active). According to theSolarWinds Platform Agent requirements and port information, the direction of communication determines which firewall ports must be open.

When an agent is configured forAgent-Initiated communication(where the agent on the managed node reaches out to the SolarWinds server), it usesTCP port 17778. This port must be open for inbound traffic on the SolarWinds Main Polling Engine or Additional Polling Engine. This mode is highly beneficial for monitoring servers in DMZs or remote sites where the SolarWinds server cannot initiate a connection through the firewall, but the remote node is allowed to communicate back to the primary management network. Port 17777 (Option B) is used for the legacy Orion Information Service, and 17790 (Option D) is used for specific client-to-server messaging in different contexts, but 17778 is the dedicated, encrypted port for agent-initiated data transmission.

According to the SolarWinds Platform Administrator Guide for Hybrid Cloud Observability, theAppStack Environment Viewprovides an interactive, visual mapping of relationships between monitored entities such as applications, servers, and storage. In the provided image, it is evident thata filter is applied to show entities related to an application (A)because the left-hand navigation pane shows specific filters selected under the "Applications" category, and the main view displays a subset of the environment's total objects that correspond specifically to those application relationships. This filtering capability allows users to narrow down the environment to focus on the specific dependencies of a critical business service, such as Microsoft Active Directory or a SQL Server instance, which are shown as filtered groups in the sidebar.

Furthermore, it can be concluded thatthe option to hide categories with no objects is selected (B). A standard, unfiltered AppStack view typically displays every possible layer of the IT stack—including Transactions, LUNs, Pools, and Arrays—regardless of whether they contain active entities. However, in the provided view, only categories containing entities relevant to the current filter (such as Applications, Database Instances, Servers, and Volumes) are visible. This indicates that the "Hide categories with no objects" setting is active, which is a standard customization used to clean up the interface and highlight only the active parts of the dependency map.

While the view shows storage-related entities like "Volumes," this does not confirm whether theStorage Resource Monitor (SRM) is not installed (C), as basic volume data can often be collected via standard node polling. Additionally, the AppStack interface itself does not provide enough diagnostic data to verify if theuser account is given administrator access rights (D), as these visual elements are accessible to non-admin users with appropriate view permissions. Therefore, A and B are the only verified conclusions based on the visual evidence of the filtered environment.

In the SolarWinds Platform, visibility of specific reports is managed throughReport Limitations. According to theSolarWinds Platform Reporting Guide, even if a user has general permissions to view nodes, an administrator can restrict their access to specific reports to ensure data privacy or to simplify their workspace.

By creating a report limitation, you define a rule—such as filtering by a custom property or report category—and apply it directly to a user's account settings. Once applied, the user will only see the reports that match the criteria of that limitation when they navigate to the Reports section of the Web Console. This is different from a standardAccount Limitation(Option D), which restricts the visibility of the nodes themselves across the entire platform. Using a report-specific limitation allows the user to still monitor the nodes in real-time views while preventing them from accessing sensitive historical or inventory data contained in specific PDF or web-based reports.

Anomaly-Based Alertingrepresents a shift from static thresholds to behavioral analysis in the HCO platform. According to theSolarWinds HCO Alerting Enginedocumentation, this feature uses machine learning to establish a "baseline" for specific metrics like CPU load or memory usage over a period of 7 to 30 days.

The primary benefit is that itanalyzes entity behaviorand triggers an alert only when a metric deviates significantly from its historical "normal" for that specific day and time. For example, if a server traditionally runs at 90% CPU during a Sunday night backup, a static 80% threshold alert would trigger a "false positive" every week. Anomaly-based alerting learns this behavior and will only fire an alert if the CPU hits 90% on a Tuesday morning when the normal load is only 20%.

This reduces alert noise by focusing ontrue anomaliesrather than simple threshold violations. It does not "remove the requirement for trigger conditions" (Options B and C); instead, it replaces a static numerical threshold with a dynamic, machine-learned threshold. The administrator still defineswhichentities to monitor andhowsensitive the anomaly detection should be.

The ability to create or modify reports is a high-level administrative function in the SolarWinds Platform, distinct from the ability to simply view them. According to theSolarWinds Platform User Account Managementguide, this is controlled by theReport Managementright.

To restrict a specific group of users from creating or editing reports while still allowing them to view existing ones, the administrator mustremove the "Manage Reports" permissionfrom their user accounts. When this right is set to "No," the"Manage Reports" buttonis hidden from the "All Reports" view for that user. They can still click on and run any report they have access to, but they will lack the interface options to enter the "Report Builder," change schedules, or delete entries. This provides a secure way to delegate report consumption to the wider team while centralizing report creation within a smaller group of "power users" or administrators. Option D is incorrect as it refers toAlerts, which is a separate permission set entirely.