Examkin

Question

Difficulty: HardNetwork Logging and Auditing

During a security compliance audit, a network administrator discovers that edge routers are transmitting critical audit logs across an untrusted WAN connection using default Syslog configurations over UDP port 514. Updated corporate policy mandates that all network event logging must guarantee connection-oriented reliable delivery and encrypt log payloads in transit to prevent eavesdropping. Which configuration modification should the administrator implement to fulfill both requirements?

  1. Reconfigure Syslog forwarding to use TLS over TCP port 6514.Answer
  2. B
    Switch the Syslog transport protocol from UDP port 514 to TCP port 514.
  3. C
    Migrate log transport to SNMPv2c traps configured over UDP port 162.
  4. D
    Configure Syslog to stream encrypted event logs over UDP port 6514.

Answer

Reconfigure Syslog forwarding to use TLS over TCP port 6514.
Reconfiguring Syslog forwarding to use TLS over TCP port 6514 satisfies both security mandates. TCP ensures connection-oriented, reliable packet delivery with retransmissions across the WAN, while TLS provides cryptographic privacy and payload integrity for logs in transit.

Step-by-Step Solution

1
Analyze the audit compliance requirements.
Identified two mandatory technical requirements: connection-oriented reliable delivery and encrypted payload transmission for log forwarding across the WAN.
Default Syslog uses UDP port 514, which is connectionless (unreliable) and unencrypted (cleartext).
2
Evaluate transport layer protocols for log forwarding.
TCP guarantees connection-oriented reliable delivery through sequence numbers and acknowledgments, whereas UDP offers no delivery guarantees.
Connection reliability requires replacing UDP with TCP.
3
Evaluate security and standard port specifications for secure Syslog.
RFC 5425 establishes Syslog over TLS using TCP port 6514 to provide cryptographic privacy (encryption) and data integrity.
Standard TCP port 514 does not provide TLS encryption by default, whereas TCP port 6514 is designated specifically for Syslog encapsulated within TLS.

Key Concept

Syslog over TLS (TCP Port 6514) Transport Security and Reliability
Estimated Time:2m 0s
Rate this question

Topics

Network Logging and Auditing

More questions from this topic