How would you identify the problematic machine?

The ABC.com network consists of a single Active Directory domain named ABC.com. All servers
on the ABC.com network run Windows Server 2003. The ABC.com network also contains a file
server named ABC-SR10.
A ABC.com user named Rory Allen complains that when connecting to ABC-SR10, it often takes
quite some time to respond. Other users report the same problem.

Your investigations reveal that the network interface on ABC-SR10 has a large load during times
when the server is slow to respond. You suspect that one of the network computers is causing the
problem.
How would you identify the problematic machine?

A.
By examining the event logs on ABC-SR10.

B.
By viewing the Local Area Connection status on ABC-SR10.

C.
By using Network Monitor to inspect the network traffic on the client computers.

D.
By using System Monitor to inspect the performance monitor counters on ABC-SR10.

E.
By examining the event logs on the client computers.

F.
By using System Monitor to inspect the performance monitor counters on the client computers.

G.
By using Network Monitor to inspect the network traffic on ABC-SR10.

Explanation:
Network Monitor Capture Utility (Netcap.exe) is a command-line Support Tool that
allows a system administrator to monitor network packets and save the information to a capture
(.cap) file. You can use information gathered by using Network Monitor Capture Utility to analyze
network use patterns and diagnose specific network problems.
This command-line tool allows a system administrator to monitor packets on a LAN and write the
information to a log file. NetCap uses the Network Monitor Driver to sniff packets on local network
segments.
Network Monitor captures network traffic information and gives detailed information about the
frames being sent and received. This tool can help you analyze complex patterns of network
traffic. Network Monitor can help you view the header information included in HTTP and FTP
requests. Generally, you need to design a capture filter, which functions like a database query and
singles out a subset of the frames being transmitted. You can also use a capture trigger that
responds to events on your network by initiating an action, such as starting an executable file. An
abbreviated version of Network Monitor is included with members of the Windows Server 2003
family. A complete version of Network Monitor is included with Microsoft Systems Management
Server.
Reference:
Craig Zacker, MCSE Self-Paced Training Kit (Exam 70-293): Planning and Maintaining a Microsoft
Windows Server 2003 Network Infrastructure, Microsoft Press, Redmond, Washington, 2004, pp.
6: 7-12
J. C. Mackin, Ian McLean, MCSA/MCSE self-paced training kit (exam 70-291): implementing,
managing, and maintaining a Microsoft Windows Server 2003 network infrastructure, Microsoft
Press, Redmond, Washington, 2004, Chapter 3, and 6.
Dan Holme, and Orin Thomas, MCSA/MCSE Self-Paced Training Kit (Exam 70-290): Managing

and Maintaining a Microsoft Windows Server 2003 Environment, Microsoft Press, Redmond,
Washington, 2004, Chapter 12.