Examkin

Soru

Zorluk: KolayNetwork Logging and Auditing

A network engineer is configuring infrastructure devices to forward event logs to a centralized Security Information and Event Management (SIEM) server for auditing. Which TWO of the following configurations will ensure that log events are accurately correlated and securely transmitted across the network? (Select TWO.)

  1. Synchronize system clocks across all network devices using Network Time Protocol (NTP).Cevap
  2. Forward Syslog messages over TLS using TCP port 6514.Cevap
  3. C
    Transmit Syslog messages using unencrypted UDP port 514 to secure message traffic.
  4. D
    Configure SNMPv1 traps to encrypt real-time audit notifications.

Cevap

The correct configurations are synchronizing system clocks across devices using Network Time Protocol (NTP) and forwarding Syslog messages over TLS using TCP port 6514.
Centralized logging and auditing rely on two main pillars: accurate timeline reconstruction and secure log transport. Synchronizing system clocks via NTP ensures all log events share a consistent timestamp for SIEM event correlation. Transporting Syslog messages over TLS using TCP port 6514 encrypts audit logs in transit to protect sensitive network data.

Adım Adım Çözüm

1
Identify the requirement for accurate event correlation in log auditing.
Network Time Protocol (NTP) provides consistent time stamping across all devices, enabling precise sequence reconstruction during log analysis.
Without unified time sources, timestamps from different devices will mismatch, preventing accurate incident correlation.
2
Identify the requirement for secure transmission of log data.
Syslog over TLS (TCP port 6514) establishes a cryptographically secure transport channel.
Cleartext protocols like standard UDP 514 Syslog or SNMPv1 expose auditing details to network sniffing.

Anahtar Kavram

Centralized Log Security, Event Correlation, and Transport Encryption
Bu soruyu puanla

Konular

Network Logging and Auditing

Bu konudan daha fazla soru