What is network baselining and what is its role in incident detection?

What is network baselining and what is its role in incident detection?

• A. Baselining defines target utilization goals for all devices.
• B. Baselining defines normal performance metrics; deviations signal potential faults, capacity constraints, or security incidents.
• C. Baselining is a process to set maximum bandwidth for links.
• D. Baselining is a way to schedule maintenance windows.

Answer: (B)

Baselining is about establishing what normal performance looks like for a network over time. You collect data on metrics such as throughput, latency, jitter, packet loss, and device utilization so you know the typical ranges for your environment. With that baseline, you can spot deviations that hint at problems. If traffic spikes, latency increases, error rates rise, or utilization diverges from the usual pattern, those anomalies can indicate faults, capacity constraints, or security issues like unusual traffic or potential intrusions. Baselining also helps reduce false alarms because decisions are based on real, observed behavior rather than generic thresholds, and it can adapt to regular patterns such as time-of-day or day-of-week variations. The other options describe specific configurations or processes that aren’t about understanding normal behavior or detecting anomalies: setting target utilization goals is planning, fixing maximum bandwidth is a QoS limit, and scheduling maintenance windows is operational timing.

Baselining is about establishing what normal performance looks like for a network over time. You collect data on metrics such as throughput, latency, jitter, packet loss, and device utilization so you know the typical ranges for your environment. With that baseline, you can spot deviations that hint at problems. If traffic spikes, latency increases, error rates rise, or utilization diverges from the usual pattern, those anomalies can indicate faults, capacity constraints, or security issues like unusual traffic or potential intrusions. Baselining also helps reduce false alarms because decisions are based on real, observed behavior rather than generic thresholds, and it can adapt to regular patterns such as time-of-day or day-of-week variations. The other options describe specific configurations or processes that aren’t about understanding normal behavior or detecting anomalies: setting target utilization goals is planning, fixing maximum bandwidth is a QoS limit, and scheduling maintenance windows is operational timing.