A network engineer is configuring infrastructure devices to forward event logs to a centralized Security Information and Event Management (SIEM) server for auditing. Which TWO of the following configurations will ensure that log events are accurately correlated and securely transmitted across the network? (Select TWO.)
- Synchronize system clocks across all network devices using Network Time Protocol (NTP).Answer
- Forward Syslog messages over TLS using TCP port 6514.Answer
- CTransmit Syslog messages using unencrypted UDP port 514 to secure message traffic.
- DConfigure SNMPv1 traps to encrypt real-time audit notifications.
Answer
The correct configurations are synchronizing system clocks across devices using Network Time Protocol (NTP) and forwarding Syslog messages over TLS using TCP port 6514.
Centralized logging and auditing rely on two main pillars: accurate timeline reconstruction and secure log transport. Synchronizing system clocks via NTP ensures all log events share a consistent timestamp for SIEM event correlation. Transporting Syslog messages over TLS using TCP port 6514 encrypts audit logs in transit to protect sensitive network data.
Step-by-Step Solution
Key Concept
Centralized Log Security, Event Correlation, and Transport Encryption