Examkin

Question

Difficulty: MediumNetwork Logging and Auditing

A network administrator needs to configure centralized log forwarding from edge switches to a SIEM collector across an untrusted WAN connection. Corporate compliance mandates that log transmission must guarantee delivery confirmation to prevent log loss during congestion and secure event details against eavesdropping in transit. Which configuration best satisfies both requirements?

  1. A
    Forward Syslog messages over UDP port 514
  2. Forward Syslog messages over TCP port 6514 using TLS encryptionAnswer
  3. C
    Forward Syslog messages over TCP port 514 with standard plaintext formatting
  4. D
    Configure SNMPv2c trap notifications using community strings

Answer

Syslog forwarding using TCP port 6514 with Transport Layer Security (TLS) encryption
Configuring Syslog to transmit over TCP port 6514 with TLS provides both connection-oriented reliability (preventing log loss during WAN congestion via TCP acknowledgments) and strong cryptographic privacy (ensuring audit logs remain encrypted across untrusted networks).

Step-by-Step Solution

1
Analyze transport reliability requirements
Identified TCP as the required transport protocol to ensure guaranteed delivery and acknowledgment over congested WAN links.
UDP is connectionless and drops packets silently during congestion, whereas TCP uses acknowledgments and retransmissions.
2
Analyze encryption and privacy requirements
Identified TLS encapsulation as necessary for encrypting telemetry data in transit across untrusted connections.
Plaintext protocols expose sensitive audit logs and network telemetry to eavesdropping.
3
Select protocol standard and port assignment
Selected Syslog over TLS operating on standard port TCP 6514.
RFC 5425 specifies TCP port 6514 for secure Syslog transport utilizing TLS.

Key Concept

Secure and Reliable Syslog Transport (Syslog-TLS on TCP 6514)
Rate this question

Topics

Network Logging and Auditing

More questions from this topic