6.5 Explain the Function of Syslog CYBERSECURITY-APPRENTICE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   After specifying the syslog server address, what additional configuration is commonly needed on a device?

   • AConfigure the device to use a different syslog port for each message
   • BAssign a static IP address to the syslog server
   • CSet the logging facility and severity level to control which messages are sent
   • DDisable all other logging to avoid conflicts
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A network administrator is configuring a router to send syslog messages to a central server. The administrator wants to ensure that only messages related to system-level events (e.g., system reboots, resource issues) are sent, and not messages from other processes like user authentication. Which configuration setting should the administrator adjust?

   • ASet the timestamp to a specific time range
   • BSet the hostname to the router's own hostname
   • CSet the severity level to 'emergency'
   • DSet the facility to 'syslog' or 'local0'
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which scenario best illustrates the role of syslog in centralized log management?

   • AA network administrator configures SNMP traps to monitor device status in real time
   • BA network administrator reviews logs from multiple firewalls and switches in a single SIEM dashboard
   • CA user connects to a remote server using SSH to run commands
   • DA firewall blocks traffic based on a security policy
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A security operations center (SOC) analyst is investigating a security incident. The analyst needs to correlate events from multiple sources, including a firewall, a web server, and an authentication server. The logs are currently stored locally on each device. What is the most significant challenge the analyst faces in this investigation?

   • AThe logs are too large to be analyzed manually
   • BThe logs are stored in a proprietary format that cannot be read
   • CThe logs are not encrypted, so they cannot be used as evidence
   • DThe logs are in different formats and lack a common timestamp reference
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A network engineer is configuring syslog for a critical firewall. The company's compliance policy requires that no log messages be lost during a network outage. The engineer is deciding between using UDP or TCP for syslog transport. Which consideration is most important for this decision?

   • ATCP is simpler to configure and requires less maintenance
   • BTCP provides reliable delivery, ensuring messages are not lost during transmission
   • CUDP is faster and has lower overhead, making it the best choice for high-volume logging
   • DUDP is more secure because it is less commonly used
   Reveal Solution Discussion Select an answer first