Examkin

Soru

Zorluk: OrtaNetwork Logging and Auditing

During a routine audit of core network operations, a security analyst discovers that event logs generated by perimeter firewalls are occasionally dropped during bandwidth spikes. Additionally, network packet captures reveal that log messages are transmitted across the internal network in unencrypted text. Which configuration update will resolve log delivery failures while ensuring log confidentiality during transit?

  1. Implement Syslog transport using TCP over port 6514 encrypted with TLS.Cevap
  2. B
    Migrate centralized logging to standard Syslog over UDP port 514.
  3. C
    Configure device event monitoring using SNMPv2c traps over UDP port 162.
  4. D
    Enable unencrypted Syslog message forwarding using TCP port 514.

Cevap

Implement Syslog transport using TCP over port 6514 encrypted with TLS.
Implementing Syslog over TCP port 6514 with TLS satisfies both audit requirements. TCP guarantees delivery through sequence numbers and acknowledgments, preventing log message loss during congestion. TLS encrypts log packets during transmission, preserving confidentiality.

Adım Adım Çözüm

1
Identify reliability requirement
TCP must be selected over UDP to guarantee connection-oriented delivery and retransmission of lost log packets during network congestion.
UDP lacks delivery acknowledgments and flow control, leading to silent drops.
2
Identify confidentiality requirement
TLS encryption must be applied to secure log data in transit.
Standard Syslog traffic is plaintext; TLS wraps the syslog stream to prevent eavesdropping.
3
Verify standard port assignment
Syslog over TLS standardly uses TCP port 6514.
RFC 5425 specifies TCP port 6514 for secure Syslog transport.

Anahtar Kavram

Secure Syslog Transport and Log Integrity
Tahmini Süre:1m 15s
Bu soruyu puanla

Konular

Network Logging and Auditing

Bu konudan daha fazla soru