Examkin

Question

Difficulty: Very hardNetwork Logging and Auditing

A network security auditor is reviewing an enterprise organization's network logging and monitoring infrastructure to meet stringent compliance regulations. The audit reveals two major vulnerabilities: (1) SNMP management traffic captures reveal cleartext interface statistics and OID payloads despite network administrators requiring password access to the monitoring console, and (2) during periodic core switch link saturation, critical Syslog alerts from edge devices are consistently dropped before reaching the centralized SIEM. Which combination of configuration updates will resolve both compliance findings by ensuring cryptographic privacy of network management payloads and reliable, tamper-resistant log delivery?

  1. Migrate SNMP monitoring to SNMPv3 configured for authPriv using SHA authentication and AES encryption, and reconfigure Syslog transport to use TLS over TCP port 6514.Answer
  2. B
    Reconfigure SNMP to SNMPv3 operating at the authNoPriv security level using SHA authentication, and retain Syslog transmission over standard UDP port 514 wrapped in an IPsec tunnel.
  3. C
    Upgrade management monitoring to SNMPv2c using complex community strings, and increase the Syslog server ring buffer capacity while preserving UDP port 514 transport.
  4. D
    Configure SNMPv3 in noAuthNoPriv mode with custom access control lists, and reconfigure the Syslog daemon to transmit audit events over TCP port 514.

Answer

Migrate SNMP monitoring to SNMPv3 configured for authPriv using SHA authentication and AES encryption, and reconfigure Syslog transport to use TLS over TCP port 6514.
SNMPv3 authPriv combines cryptographic user authentication (such as SHA) with symmetric payload encryption (such as AES), preventing eavesdroppers from reading cleartext OID values and interface stats. Furthermore, configuring Syslog over TLS using TCP port 6514 ensures both cryptographic log security and reliable, acknowledged packet delivery that prevents log loss during network congestion.

Step-by-Step Solution

1
Identify the required SNMP security model for management traffic privacy
SNMPv3 with the authPriv security level is required because authNoPriv only provides message integrity/authentication, whereas authPriv adds symmetric encryption (such as AES) to protect payload confidentiality.
Cleartext OIDs and statistics must be encrypted in transit to satisfy compliance regulations.
2
Analyze the log packet drop issue during network congestion
Standard Syslog uses UDP port 514, which is connectionless and unacknowledged, leading to silently dropped log packets when buffers overflow during traffic spikes.
A connection-oriented transport protocol (TCP) is necessary to ensure acknowledgment and delivery reliability.
3
Select the correct secure, reliable Syslog transport configuration
Syslog over TLS utilizes TCP port 6514, delivering both transport-layer security/encryption and reliable TCP delivery semantics.
Port 6514 is the standard IANA-assigned port for Syslog over TLS (RFC 5425).

Key Concept

SNMPv3 Security Levels (authPriv) and Secure Syslog Transport (TLS/TCP Port 6514)
Rate this question

Topics

Network Logging and Auditing

More questions from this topic