Examkin

Question

Difficulty: Very hardNetwork Logging and Auditing

During a compliance audit of an organization's network monitoring infrastructure, an auditor notes that event log messages and SNMP telemetry are vulnerable to packet loss, eavesdropping, and tampering across WAN links. To remediate these findings, the security engineer must ensure that centralized log forwarding to the SIEM appliance guarantees delivery acknowledgment, encrypts message traffic over standard secure ports, and that SNMP polling enforces cryptographic user authentication along with payload privacy. Which of the following configuration sets correctly fulfills all specified requirements?

  1. Configure Syslog log forwarding over TCP port 6514 using TLS encryption, and implement SNMPv3 with the authPriv security level.Answer
  2. B
    Configure Syslog log forwarding over UDP port 514 using TLS encryption, and implement SNMPv3 with the authNoPriv security level.
  3. C
    Configure Syslog log forwarding over TCP port 514 using TLS encryption, and implement SNMPv2c using community strings with access control lists.
  4. D
    Configure Syslog log forwarding over TCP port 6513 using TLS encryption, and implement SNMPv3 with the noAuthNoPriv security level.

Answer

The correct implementation requires Syslog log forwarding over TCP port 6514 using TLS encryption, paired with SNMPv3 utilizing the authPriv security level.
The requirement for reliable and encrypted log forwarding necessitates using TCP port 6514 with TLS (RFC 5425). Standard UDP 514 lacks connection state and encryption. For SNMP monitoring, satisfying both authentication and privacy requirements requires SNMPv3 configured with the authPriv security level (which uses authentication algorithms along with payload privacy encryption).

Step-by-Step Solution

1
Identify the required transport protocol and port for secure, reliable log forwarding.
Syslog using TCP port 6514 with TLS provides guaranteed delivery and encryption.
Standard Syslog uses UDP port 514 (unreliable and unencrypted). TLS-encrypted Syslog is standardized under RFC 5425 using TCP port 6514.
2
Determine the appropriate SNMP version and security model to satisfy authentication and payload privacy requirements.
SNMPv3 with the authPriv security level is required.
SNMPv1 and SNMPv2c send credentials in cleartext. SNMPv3 authNoPriv authenticates but does not encrypt; authPriv encrypts both header/authentication credentials and payload data using symmetric ciphers.
3
Synthesize the findings to select the matching configuration choice.
Combining Syslog over TCP 6514 (TLS) and SNMPv3 authPriv fulfills all audit requirements.
This combination satisfies both reliable/encrypted log transport and authenticated/encrypted SNMP management polling.

Key Concept

Syslog over TLS (TCP Port 6514) and SNMPv3 Security Levels (authPriv)
Estimated Time:1m 30s
Rate this question

Topics

Network Logging and Auditing

More questions from this topic