Soru

Zorluk: Çok zorNetwork Logging and Auditing

An enterprise network engineering team is designing a high-security log forwarding and auditing infrastructure across multi-site edge routers. The compliance policy mandates that event log forwarding to the centralized SIEM must guarantee transport reliability and payload encryption, while active remote device telemetry queries must enforce both cryptographic user authentication and data payload privacy encryption. Which of the following configuration choices and protocols satisfy these requirement criteria? (Select TWO.)

  1. Forward Syslog events using TCP port 6514 encapsulated with Transport Layer Security (TLS)Cevap
  2. Configure SNMPv3 polling and trap generation using the authPriv security modelCevap
  3. C
    Forward Syslog events using UDP port 514 with native TLS session renegotiation
  4. D
    Configure SNMPv3 polling using the authNoPriv security level to encrypt telemetry data without credential overhead

Cevap

The correct configurations are forwarding Syslog events over TCP port 6514 using TLS encapsulation, and implementing SNMPv3 using the authPriv security model.
Secure log aggregation requiring encrypted and reliable transport must use Syslog over TLS on TCP port 6514. Device telemetry requiring both authentication and encryption mandates SNMPv3 at the authPriv security level.

Adım Adım Çözüm

1
Analyze log transport encryption and reliability requirements
Syslog over TLS utilizes TCP port 6514 to deliver connection reliability, message integrity, and payload encryption.
Standard UDP port 514 lacks guaranteed delivery and transport-layer encryption capabilities.
2
Evaluate SNMPv3 security levels for authentication and privacy
SNMPv3 authPriv enforces both cryptographic user authentication (HMAC-SHA/MD5) and packet privacy encryption (AES/DES).
The authNoPriv level provides authentication without encryption, failing the requirement for payload privacy.

Anahtar Kavram

Secure Logging and SNMP Security Models
Bu soruyu puanla