Examkin

Question

Difficulty: MediumNetwork Logging and Auditing

A network security engineer is auditing the logging infrastructure of an enterprise network. The engineer discovers that network infrastructure devices transmit sensitive audit logs to a central SIEM server over an unencrypted channel, and critical log messages are lost during peak traffic congestion. Which protocol configuration change will ensure encrypted transport and guaranteed delivery of the audit logs?

  1. Configure Syslog forwarding to use TLS over TCP port 6514.Answer
  2. B
    Reconfigure Syslog to use UDP transport over port 6514 to enable transport-level buffering.
  3. C
    Migrate log telemetry to SNMPv2c using read-only community strings to provide message encryption.
  4. D
    Reconfigure Syslog to transmit log messages securely over SSH using TCP port 23.

Answer

Configure Syslog forwarding to use TLS over TCP port 6514.
Configuring Syslog to use TLS over TCP port 6514 ensures connection-oriented transport with delivery guarantees (via TCP acknowledgments and retransmissions) and privacy (via TLS encryption).

Step-by-Step Solution

1
Identify transport reliability requirements
Recognize that connection-oriented TCP is required to prevent packet loss and guarantee log delivery during network congestion.
UDP is connectionless and drops packets when network links are saturated.
2
Identify security and encryption requirements
Determine that TLS-based encapsulation is necessary to protect sensitive audit logs in transit.
Standard Syslog over UDP port 514 sends log entries in unencrypted cleartext.
3
Select standard protocol and port specification
Select Syslog over TLS running on TCP port 6514.
RFC 5425 establishes TCP port 6514 as the standard port for TLS-encrypted Syslog transport.

Key Concept

Secure Syslog Transport (Syslog over TLS / TCP 6514)
Rate this question

Topics

Network Logging and Auditing

More questions from this topic