SOLARWINDS SERVER AND APPLICATION
MONITOR (SAM) CERTIFICATION EXAM
,Question 1: A SolarWinds SAM administrator creates a custom PowerShell
script component monitor to evaluate a proprietary banking service on a
Windows Server 2022 node. The script executes locally via the SolarWinds
Agent. What exact string output syntax and exit code must the PowerShell
script return to register a 'Critical' threshold state with a custom metric
named 'QueueLength' of 45?
A. Output 'Value=45;Status=Critical' to stderr and terminate with exit code 1
B. Output 'STATUS: CRITICAL | QueueLength=45' to stdout and terminate with exit code
0
C. Output 'Statistic.QueueLength: 45' to stdout and terminate the script with exit code 2
(Exit 2)
D. Output 'Statistic: 45' to a local log file and terminate with exit code 255
Answer: C - Output 'Statistic.QueueLength: 45' to stdout and terminate the script with exit
code 2 (Exit 2)
Rationale: SolarWinds SAM custom scripts (PowerShell, VBScript, Bash) strictly require
statistical outputs formatted as 'Statistic.Name: Value' (or simply 'Statistic: Value'). To
report component status to Orion, exit code 0 corresponds to Up/OK, exit code 1 to
Warning, exit code 2 to Critical, and exit code 3 to Unknown.
,Question 2: Which remote management protocol and credential privilege
levels are required by SolarWinds SAM AppInsight for IIS to collect
application pool, website, and worker process metrics?
A. Telnet access enabled with IIS Anonymous Authentication
B. WinRM (Windows Remote Management) or WMI enabled with local Administrator
privileges on the target IIS web server
C. SSH Key authentication with restricted chroot jail access
D. SNMPv2c read-only community string with guest user access
Answer: B - WinRM (Windows Remote Management) or WMI enabled with local
Administrator privileges on the target IIS web server
Rationale: AppInsight for IIS relies on WinRM or WMI (as well as Remote
Registry/PowerShell) to gather deep IIS metabase details, AppPool statuses, worker
process performance, and SSL certificate expiration. Local administrator rights (or
properly delegated WinRM/WMI permissions) are required on the target server.
, Question 3: A financial institution deploys SolarWinds SAM to monitor
servers located in a strictly isolated DMZ subnet. Security policy forbids
inbound connections from the internal Orion Main Polling Engine into the
DMZ. Which SolarWinds Agent deployment mode and port configuration
should be selected to allow SAM to monitor these DMZ servers?
A. Agent-Initiated communication mode requiring bidirectional open UDP ports 161 and
162 only
B. Agentless WMI monitoring routed through a secondary HTTP proxy on port 80
C. Agent-Initiated (Passive) communication mode, where the Agent initiates an outbound
connection to the Orion Poller over port 17778 (or 5671 for RabbitMQ)
D. Server-Initiated (Active) communication mode, where the Orion Poller opens an
inbound connection over SMB port 445
Answer: C - Agent-Initiated (Passive) communication mode, where the Agent initiates an
outbound connection to the Orion Poller over port 17778 (or 5671 for RabbitMQ)
Rationale: In Agent-Initiated mode, the agent installed in the isolated DMZ initiates an
outbound connection to the Orion Main/Additional Polling Engine over port 17778 (or
5671/5672 RabbitMQ Messaging). This avoids opening inbound firewall ports from the
Orion server into the secure DMZ.
MONITOR (SAM) CERTIFICATION EXAM
,Question 1: A SolarWinds SAM administrator creates a custom PowerShell
script component monitor to evaluate a proprietary banking service on a
Windows Server 2022 node. The script executes locally via the SolarWinds
Agent. What exact string output syntax and exit code must the PowerShell
script return to register a 'Critical' threshold state with a custom metric
named 'QueueLength' of 45?
A. Output 'Value=45;Status=Critical' to stderr and terminate with exit code 1
B. Output 'STATUS: CRITICAL | QueueLength=45' to stdout and terminate with exit code
0
C. Output 'Statistic.QueueLength: 45' to stdout and terminate the script with exit code 2
(Exit 2)
D. Output 'Statistic: 45' to a local log file and terminate with exit code 255
Answer: C - Output 'Statistic.QueueLength: 45' to stdout and terminate the script with exit
code 2 (Exit 2)
Rationale: SolarWinds SAM custom scripts (PowerShell, VBScript, Bash) strictly require
statistical outputs formatted as 'Statistic.Name: Value' (or simply 'Statistic: Value'). To
report component status to Orion, exit code 0 corresponds to Up/OK, exit code 1 to
Warning, exit code 2 to Critical, and exit code 3 to Unknown.
,Question 2: Which remote management protocol and credential privilege
levels are required by SolarWinds SAM AppInsight for IIS to collect
application pool, website, and worker process metrics?
A. Telnet access enabled with IIS Anonymous Authentication
B. WinRM (Windows Remote Management) or WMI enabled with local Administrator
privileges on the target IIS web server
C. SSH Key authentication with restricted chroot jail access
D. SNMPv2c read-only community string with guest user access
Answer: B - WinRM (Windows Remote Management) or WMI enabled with local
Administrator privileges on the target IIS web server
Rationale: AppInsight for IIS relies on WinRM or WMI (as well as Remote
Registry/PowerShell) to gather deep IIS metabase details, AppPool statuses, worker
process performance, and SSL certificate expiration. Local administrator rights (or
properly delegated WinRM/WMI permissions) are required on the target server.
, Question 3: A financial institution deploys SolarWinds SAM to monitor
servers located in a strictly isolated DMZ subnet. Security policy forbids
inbound connections from the internal Orion Main Polling Engine into the
DMZ. Which SolarWinds Agent deployment mode and port configuration
should be selected to allow SAM to monitor these DMZ servers?
A. Agent-Initiated communication mode requiring bidirectional open UDP ports 161 and
162 only
B. Agentless WMI monitoring routed through a secondary HTTP proxy on port 80
C. Agent-Initiated (Passive) communication mode, where the Agent initiates an outbound
connection to the Orion Poller over port 17778 (or 5671 for RabbitMQ)
D. Server-Initiated (Active) communication mode, where the Orion Poller opens an
inbound connection over SMB port 445
Answer: C - Agent-Initiated (Passive) communication mode, where the Agent initiates an
outbound connection to the Orion Poller over port 17778 (or 5671 for RabbitMQ)
Rationale: In Agent-Initiated mode, the agent installed in the isolated DMZ initiates an
outbound connection to the Orion Main/Additional Polling Engine over port 17778 (or
5671/5672 RabbitMQ Messaging). This avoids opening inbound firewall ports from the
Orion server into the secure DMZ.
