Examkin

Question

Difficulty: MediumNetwork Logging and Auditing

An auditor notes that an organization's network monitoring traffic is transmitted without encryption and that critical log messages are lost during periods of high link utilization. The network administrator must reconfigure telemetry protocols on core switches to ensure reliable log transport, cryptographic confidentiality, and authenticated management querying. Which of the following implementations address the auditor's security and reliability findings? (Select TWO.)

  1. Forward Syslog messages using TLS encryption over TCP port 6514.Answer
  2. Deploy SNMPv3 configured with the authPriv security model.Answer
  3. C
    Transmit Syslog data over UDP port 514 to ensure connection-oriented delivery during congestion.
  4. D
    Configure SNMPv2c using read-only community strings to encrypt management queries.

Answer

The network administrator should forward Syslog messages using TLS over TCP port 6514 and deploy SNMPv3 configured with the authPriv security level.
Implementing Syslog over TLS using TCP port 6514 resolves both log dropouts and unencrypted traffic by providing connection-oriented transport with strong TLS encryption. Additionally, configuring SNMPv3 with the authPriv security level ensures that monitoring queries and trap messages are cryptographically authenticated and fully encrypted (providing both authentication and privacy).

Step-by-Step Solution

1
Identify transport reliability and log confidentiality requirements for centralized logging.
Standard Syslog uses UDP port 514, which lacks reliability and encryption. Migrating to Syslog over TCP port 6514 with TLS provides connection-oriented delivery and encryption.
TCP ensures logs are acknowledged and retransmitted if dropped, while TLS encrypts the log payload.
2
Select an authenticated and encrypted SNMP version and security mode for device management and polling.
SNMPv3 with authPriv (Authentication and Privacy) provides MD5/SHA authentication and DES/AES encryption.
SNMPv1 and SNMPv2c send community strings in cleartext, whereas SNMPv3 authPriv secures both credentials and message content.

Key Concept

Secure Logging and Management Telemetry (Syslog over TLS and SNMPv3 Security Models)
Estimated Time:1m 30s
Rate this question

Topics

Network Logging and Auditing

More questions from this topic