Examkin

Question

Difficulty: HardNetwork Logging and Auditing

A network security administrator is configuring a centralized logging and monitoring architecture across enterprise core switches. The corporate compliance policy mandates that event logs are delivered reliably with connection-oriented transport and encrypted in transit, and that SNMP polling must provide both cryptographic user authentication and payload encryption. Which of the following protocol and port configurations must the administrator implement to meet these requirements? (Select TWO.)

  1. Configure Syslog to forward messages over TCP port 6514 using TLS encryption.Answer
  2. Configure SNMPv3 using the authPriv security level for device polling.Answer
  3. C
    Configure Syslog forwarding over UDP port 514 to ensure guaranteed delivery and transport encryption.
  4. D
    Configure SNMPv2c using authNoPriv mode over TCP port 6514 for secure telemetry collection.

Answer

The administrator must configure Syslog over TCP port 6514 with TLS encryption for reliable, encrypted log transport, and configure SNMPv3 with authPriv for authenticated and encrypted telemetry polling.
Configuring Syslog over TCP port 6514 with TLS satisfies the requirement for reliable, encrypted log transport because TCP provides connection-oriented delivery and TLS encrypts data in transit. Configuring SNMPv3 with the authPriv security level satisfies the requirement for authenticated and encrypted telemetry because authPriv enforces cryptographic user authentication as well as payload encryption.

Step-by-Step Solution

1
Analyze the log forwarding compliance requirement.
Reliable connection-oriented transport with encryption requires TCP port 6514 (Syslog over TLS), whereas standard UDP port 514 lacks reliability and encryption.
TCP guarantees packet delivery via acknowledgments, and TLS encrypts the Syslog payload.
2
Analyze the SNMP monitoring security requirement.
SNMPv3 authPriv is the only SNMP configuration that provides both cryptographic user authentication and privacy (data encryption).
SNMPv1 and SNMPv2c rely on cleartext community strings, and SNMPv3 authNoPriv only provides authentication without encrypting the payload.

Key Concept

Centralized Network Audit Logging and Secure Telemetry Protocols
Rate this question

Topics

Network Logging and Auditing

More questions from this topic