Examkin

Question

Difficulty: MediumNetwork Logging and Auditing

During a routine audit of core network operations, a security analyst discovers that event logs generated by perimeter firewalls are occasionally dropped during bandwidth spikes. Additionally, network packet captures reveal that log messages are transmitted across the internal network in unencrypted text. Which configuration update will resolve log delivery failures while ensuring log confidentiality during transit?

  1. Implement Syslog transport using TCP over port 6514 encrypted with TLS.Answer
  2. B
    Migrate centralized logging to standard Syslog over UDP port 514.
  3. C
    Configure device event monitoring using SNMPv2c traps over UDP port 162.
  4. D
    Enable unencrypted Syslog message forwarding using TCP port 514.

Answer

Implement Syslog transport using TCP over port 6514 encrypted with TLS.
Implementing Syslog over TCP port 6514 with TLS satisfies both audit requirements. TCP guarantees delivery through sequence numbers and acknowledgments, preventing log message loss during congestion. TLS encrypts log packets during transmission, preserving confidentiality.

Step-by-Step Solution

1
Identify reliability requirement
TCP must be selected over UDP to guarantee connection-oriented delivery and retransmission of lost log packets during network congestion.
UDP lacks delivery acknowledgments and flow control, leading to silent drops.
2
Identify confidentiality requirement
TLS encryption must be applied to secure log data in transit.
Standard Syslog traffic is plaintext; TLS wraps the syslog stream to prevent eavesdropping.
3
Verify standard port assignment
Syslog over TLS standardly uses TCP port 6514.
RFC 5425 specifies TCP port 6514 for secure Syslog transport.

Key Concept

Secure Syslog Transport and Log Integrity
Estimated Time:1m 15s
Rate this question

Topics

Network Logging and Auditing

More questions from this topic