Question

Difficulty: MediumNetwork Logging and Auditing

A network security administrator is updating telemetry and remote management policies for core switches transmitting data across an untrusted WAN link. To comply with security auditing standards requiring both encrypted log transport and secure network polling, which TWO of the following configuration options should be implemented? (Select TWO)

  1. Configure Syslog to transmit log events using TLS over TCP port 6514.Answer
  2. Configure SNMPv3 utilizing the authPriv security level for device polling.Answer
  3. C
    Configure Syslog to transmit log events using TLS over UDP port 514.
  4. D
    Configure SNMPv2c using the authNoPriv mode to encrypt management queries.

Answer

The correct configurations are configuring Syslog to transmit log events using TLS over TCP port 6514, and configuring SNMPv3 utilizing the authPriv security level for device polling.
Comprehensive network auditing across untrusted links requires encryption for both passive event streaming and active management polling. Syslog over TLS (RFC 5425) uses TCP port 6514 to ensure secure and reliable event delivery. For active querying, SNMPv3 authPriv is required as it enforces both cryptographic user authentication and payload encryption.

Step-by-Step Solution

1
Determine the standard protocol and port for encrypted Syslog transport.
Standard unencrypted Syslog uses UDP port 514. Secure Syslog wrapper using TLS mandates TCP port 6514.
TLS encryption requires a connection-oriented transport protocol like TCP to establish secure handshakes.
2
Identify the required SNMP version and security mode for encrypted telemetry polling.
SNMPv3 with authPriv mode provides both authentication and privacy/encryption.
SNMPv1 and SNMPv2c send community strings in cleartext without encryption capabilities, while SNMPv3 authNoPriv authenticates without encrypting payload data.

Key Concept

Secure Telemetry Transport & Audit Protocols
Rate this question