Examkin

Question

Difficulty: Very hardNetwork Logging and Auditing

A network security administrator is upgrading the centralized logging and management framework across core network switches to adhere to a strict zero-trust audit policy. The updated policy mandates that all forwarded event logs and SNMP polling queries must guarantee both cryptographic payload confidentiality (encryption) and data integrity/authentication during transit across administrative subnets. Which configuration combination should the network security administrator implement to meet all audit compliance requirements?

  1. Configure Syslog to use TLS encapsulation over TCP port 6514, and enable SNMPv3 with the authPriv security level.Answer
  2. B
    Configure Syslog to use default UDP port 514, and enable SNMPv3 with the authPriv security level.
  3. C
    Configure Syslog to use TLS encapsulation over TCP port 6514, and enable SNMPv3 with the authNoPriv security level.
  4. D
    Configure Syslog to use TCP port 514, and enable SNMPv2c with complex read-only community strings.

Answer

Configure Syslog to use TLS encapsulation over TCP port 6514, and enable SNMPv3 with the authPriv security level.
To satisfy zero-trust requirements for confidentiality and authentication in network auditing, both event message transport and management query protocols must encrypt their payloads. Syslog over TLS utilizes TCP port 6514 to provide encrypted log delivery, while SNMPv3 configured at the authPriv level enforces cryptographic message authentication alongside payload encryption (privacy).

Step-by-Step Solution

1
Evaluate the protocol and transport requirements for centralized logging confidentiality.
Standard Syslog over UDP 514 and plain TCP 514 lack encryption. Secure Syslog defined in RFC 5424/5425 utilizes Transport Layer Security (TLS) over TCP port 6514 to encrypt log messages in transit.
Cryptographic protection of event log traffic requires an encrypted transport tunnel like TLS.
2
Evaluate the security level options for SNMP remote management.
SNMPv1 and SNMPv2c send community strings in plaintext. SNMPv3 offers three security levels: noAuthNoPriv (no authentication, no encryption), authNoPriv (authentication via HMAC-MD5/SHA, no encryption), and authPriv (authentication via HMAC and privacy/encryption via AES/DES).
Only SNMPv3 authPriv satisfies both authentication and encryption (confidentiality) requirements.
3
Synthesize the compliant logging and auditing controls.
Combining Syslog over TLS (TCP 6514) with SNMPv3 authPriv meets all criteria for encrypted log transport and authenticated, encrypted device management.
This combined posture enforces full end-to-end data integrity and payload confidentiality for administrative network traffic.

Key Concept

Secure Logging Transport (Syslog-TLS Port 6514) and SNMPv3 Security Levels (authPriv)
Estimated Time:2m 0s
Rate this question

Topics

Network Logging and Auditing

More questions from this topic