Examkin

Question

Difficulty: MediumNetwork Logging and Auditing

During a security audit, a network administrator notices that event logs sent from a remote switch to a central log server contain significant gaps during periods of high network utilization. Investigation reveals that log packets sent via standard Syslog are being silently dropped by intermediate routers under heavy congestion. Which transport protocol and port configuration should be configured on the switch to ensure reliable, delivery-guaranteed log transmission?

  1. Configure Syslog to use TCP on port 514Answer
  2. B
    Configure Syslog to use UDP on port 6514
  3. C
    Configure SNMPv2c trap notifications using authPriv mode on UDP port 162
  4. D
    Configure Syslog to use TCP on port 161

Answer

Configure Syslog to use TCP on port 514 to guarantee log message delivery across congested network paths.
The correct approach is configuring Syslog to use TCP on port 514. UDP-based Syslog relies on best-effort transport, which leads to lost audit events when network congestion causes packet drops. Using TCP introduces connection tracking, acknowledgments, and retransmissions to guarantee that every generated audit message reaches the central logging repository.

Step-by-Step Solution

1
Identify the cause of missing audit logs
Standard Syslog operates by default over UDP port 514, which is a connectionless protocol without delivery guarantees or retransmission mechanisms during network congestion.
UDP packets are discarded by network devices during buffer exhaustion without notifying the sender.
2
Determine the transport protocol requirement for guaranteed log delivery
Switching log transport to TCP establishes reliable, acknowledged sessions with automatic retransmission of lost packets.
TCP sliding window mechanisms and positive acknowledgments prevent log entry loss when links experience drop conditions.
3
Select the proper standard port configuration
Standard unencrypted Syslog over TCP uses port 514.
Port 514 is the standard registered port for Syslog traffic over both UDP and TCP.

Key Concept

Syslog Transport Protocols and Reliability
Rate this question

Topics

Network Logging and Auditing

More questions from this topic