Examkin

Question

Difficulty: MediumNetwork Logging and Auditing

An enterprise network engineer is configuring centralized event logging for perimeter switches sending data across a WAN connection. Security policy mandates that log messages must be delivered reliably to ensure no log loss during link congestion and that all log payloads must be cryptographically encrypted in transit. Which of the following transport protocols and port configurations best meets these compliance requirements?

  1. Syslog over TCP port 6514 using TLS encryptionAnswer
  2. B
    Syslog over UDP port 514 using TLS encryption
  3. C
    Syslog over TCP port 514 with plaintext delivery
  4. D
    SNMPv2c trap notifications over UDP port 162

Answer

Syslog over TCP port 6514 using TLS encryption best meets the requirements for reliable delivery and transport-layer confidentiality.
The configuration specifying Syslog over TCP port 6514 using TLS encryption provides connection-oriented reliability via TCP, ensuring lost packets are retransmitted during congestion, while RFC 5425 specifies TCP port 6514 as the standard port for TLS-encrypted Syslog payload transport.

Step-by-Step Solution

1
Identify the transport reliability requirement.
TCP must be selected over UDP to guarantee delivery and retransmission during network congestion.
UDP is connectionless and cannot detect or retransmit dropped log packets over a WAN.
2
Identify the cryptographic security requirement.
TLS-encrypted Syslog (RFC 5425) must be used instead of cleartext protocols.
Plaintext Syslog exposes event data to interception on untrusted transit networks.
3
Determine the standard network port assigned for secure Syslog transport.
TCP port 6514 is the standard IANA-assigned port for Syslog over TLS.
Standard unencrypted Syslog uses port 514 (UDP/TCP), whereas TLS-wrapped Syslog defaults to TCP port 6514.

Key Concept

Centralized Network Log Security and Transport Protocols
Rate this question

Topics

Network Logging and Auditing

More questions from this topic