Examkin

Question

Difficulty: MediumNetwork Logging and Auditing

During a quarterly compliance audit of an organization's network infrastructure, a security analyst identifies two key operational deficiencies: event log packets sent from border routers to the log repository are lost during high network congestion, and SNMP performance telemetry transmitted across public circuits can be read in plain text. Which set of protocol configurations directly resolves both compliance issues?

  1. Migrate Syslog logging to TCP with TLS encryption on port 6514, and configure SNMPv3 with the authPriv security level.Answer
  2. B
    Retain Syslog transport over UDP port 514 to eliminate connection setup latency, and configure SNMPv3 with the authPriv security level.
  3. C
    Migrate Syslog logging to TCP with TLS encryption on port 6514, and configure SNMPv2c using complex read-only community strings.
  4. D
    Forward Syslog events over TCP using port 22 for secure transport, and configure SNMPv3 using the noAuthNoPriv security level.

Answer

Migrate Syslog logging to TCP with TLS encryption on port 6514, and configure SNMPv3 with the authPriv security level.
The correct option addresses both audit deficiencies: TCP port 6514 with TLS provides reliable, encrypted Syslog transmission so logs are acknowledged and retransmitted if dropped, while SNMPv3 configured with authPriv provides HMAC-based message authentication and AES payload encryption for monitoring data.

Step-by-Step Solution

1
Analyze the log loss issue during network congestion
Identify that traditional Syslog over UDP (port 514) lacks delivery guarantees, leading to dropped audit records when buffers overflow.
TCP-based Syslog (specifically RFC 5425 using TLS over port 6514) ensures connection reliability, sequence confirmation, and encrypted audit transport.
2
Analyze the SNMP cleartext telemetry vulnerability
Determine that legacy SNMP versions (v1 and v2c) transmit data in plain text without cryptographic security.
SNMPv3 with the authPriv security mode mandates digest-based authentication (auth) and symmetric payload encryption (priv), securing telemetry across public networks.
3
Combine the compliant solutions
Select the configuration incorporating TCP port 6514 for Syslog and SNMPv3 authPriv.
This combination simultaneously fulfills the requirements for reliable audit log retention and secure telemetry monitoring.

Key Concept

Network Logging and Auditing Protocol Security
Rate this question

Topics

Network Logging and Auditing

More questions from this topic