Examkin

Question

Difficulty: MediumNetwork Logging and Auditing

A network administrator must update network device telemetry and event logging configurations across core switches to satisfy a new security audit mandate. The compliance policy requires log transport reliability during network congestion, cryptographic encryption for audit log traffic, and payload-level encryption for SNMP polling queries. Which TWO of the following implementation steps should the administrator execute to satisfy these audit requirements?

  1. Configure Syslog forwarding using TCP port 6514 with Transport Layer Security (TLS) encryption.Answer
  2. Configure SNMPv3 using the authPriv security level for management polling.Answer
  3. C
    Configure Syslog forwarding using UDP port 514 to guarantee encrypted log delivery.
  4. D
    Configure SNMPv3 using the authNoPriv security level to enable payload encryption.

Answer

The administrator must implement Syslog forwarding using TCP port 6514 with TLS encryption and configure SNMPv3 using the authPriv security level.
Configuring Syslog using TCP port 6514 with Transport Layer Security (TLS) satisfies the requirements for connection reliability and log traffic confidentiality. Simultaneously, deploying SNMPv3 using the authPriv security level provides both HMAC-based authentication and CBC-DES/AES payload privacy (encryption), fulfilling the requirement for encrypted polling queries.

Step-by-Step Solution

1
Analyze transport reliability and log encryption requirements
Standard Syslog utilizes UDP port 514, which lacks transport reliability and encryption. Secure Syslog uses TCP port 6514 with TLS to ensure reliable log packet delivery and payload encryption.
TCP guarantees sequence delivery and retransmission during congestion, while TLS secures the log stream.
2
Analyze SNMP security level requirements
SNMPv3 supports three security levels: noAuthNoPriv (no auth, no encryption), authNoPriv (authentication, no encryption), and authPriv (authentication and privacy/encryption).
Only authPriv satisfies the mandate for payload-level encryption during management polling.

Key Concept

Secure Logging (Syslog over TLS/TCP) and SNMPv3 Security Models
Rate this question

Topics

Network Logging and Auditing

More questions from this topic