Examkin

Question

Difficulty: Very hardNetwork Logging and Auditing

In enterprise network operations and security auditing, different logging protocols, severity levels, and monitoring frameworks fulfill distinct roles. Match each network auditing or logging component on the left with its correct operational description on the right.

  • Syslog FacilityCategorizes the software application or subsystem generating the event record (e.g., auth, daemon, local0).
  • Syslog Severity Level 3 (Error)Indicates error conditions that impact single operational features but do not render the host entirely unusable.
  • NetFlow / IPFIX ExportProvides statistical traffic telemetry including source/destination IP addresses, port numbers, and byte counts without full packet payloads.
  • SNMPv3 authPrivProvides HMAC-based authentication alongside AES/DES payload encryption for centralized management telemetry.

Answer

Syslog Facility matches the item describing software application/subsystem categorization. Syslog Severity Level 3 (Error) matches the item describing error conditions impacting single operational features. NetFlow / IPFIX Export matches the item describing statistical traffic telemetry without full payloads. SNMPv3 authPriv matches the item describing HMAC authentication alongside payload encryption.
Each logging and monitoring component is paired precisely with its defining technical function: Syslog Facility categorizes originating source subsystems; Syslog Severity 3 represents non-fatal error conditions; NetFlow exports conversation metadata without full payload contents; and SNMPv3 authPriv ensures both authentication and payload confidentiality.

Step-by-Step Solution

1
Analyze the Syslog architecture fields.
Identify that Syslog messages separate origin (Facility) from importance (Severity). Facility represents the originating subsystem.
Facility codes categorize log sources like auth, daemon, or user-defined local facilities.
2
Evaluate standard Syslog numerical severity levels.
Determine that Level 3 corresponds to 'Error', which denotes non-fatal subsystem errors.
Numerical severity ranks from 0 (Emergency) to 7 (Debug); Level 3 indicates operational component errors.
3
Differentiate network traffic monitoring protocols.
Map NetFlow/IPFIX to flow-based metadata collection rather than full packet capture or log event messages.
NetFlow aggregates connection tuples (IPs, ports, protocols, counters) for audit trails and performance baselining.
4
Verify SNMP Security Models under SNMPv3.
Confirm authPriv enforces both cryptographic authentication and privacy encryption.
authNoPriv provides authentication without encryption, while authPriv adds symmetric payload encryption.

Key Concept

Network Logging & Telemetry Mechanisms (Syslog Facilities/Severities, NetFlow vs. Syslog, and SNMPv3 Security Models)
Rate this question

Topics

Network Logging and Auditing

More questions from this topic