Examkin

Question

Difficulty: MediumNetwork Logging and Auditing

A network operations team is updating an organization's logging infrastructure across multiple branch office firewalls to meet strict compliance mandates. Currently, event log messages are transmitted across an untrusted WAN link using default unencrypted Syslog over UDP. The audit team requires that all remote log transmissions be encrypted to protect sensitive header and message contents, while also establishing a reliable, connection-oriented session. Which of the following transport configuration changes will meet these requirements?

  1. Migrate Syslog forwarding to use Transport Layer Security (TLS) over TCP port 6514.Answer
  2. B
    Migrate event log reporting to SNMPv2c traps sent over UDP port 162.
  3. C
    Reconfigure Syslog forwarding to use plain-text TCP port 514.
  4. D
    Reconfigure Syslog log forwarding to transmit messages over UDP port 22.

Answer

Migrate Syslog forwarding to use Transport Layer Security (TLS) over TCP port 6514.
The correct option specifies migrating Syslog forwarding to use Transport Layer Security (TLS) over TCP port 6514. Secure Syslog (RFC 5425) uses TLS to encrypt log messages in transit across untrusted networks and relies on TCP to guarantee connection-oriented, ordered log delivery.

Step-by-Step Solution

1
Identify the encryption and transport reliability requirements specified in the scenario.
The mandate requires encrypted transmission across an untrusted WAN link and a reliable, connection-oriented transport protocol.
Default Syslog operates over UDP port 514, which lacks both delivery guarantees and transport encryption.
2
Evaluate secure Syslog standards and default port assignments.
Syslog over TLS utilizes TCP port 6514, satisfying both connection reliability via TCP and payload encryption via TLS.
RFC 5425 defines Syslog over TLS using TCP port 6514 as the standard mechanism for secure, reliable log forwarding.

Key Concept

Syslog Security and Secure Transport Protocols (Syslog over TLS / TCP 6514)
Rate this question

Topics

Network Logging and Auditing

More questions from this topic