6.5 Explain the Function of Syslog CYBERSECURITY-APPRENTICE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the first step in configuring a network device to send syslog messages to a central log collector?

   • ACreate a user account on the syslog server for the device
   • BReboot the device to apply logging settings
   • CSpecify the IP address or hostname of the syslog server
   • DInstall a third-party logging agent on the device
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security analyst is reviewing syslog messages from a firewall to investigate a possible brute-force attack. The analyst needs to quickly filter for messages that indicate a critical authentication failure. Which field in the syslog message should the analyst examine to prioritize the most severe events?

   • AThe hostname field, to identify the affected device
   • BThe severity field, which indicates the urgency level of the event
   • CThe timestamp field, to correlate with the attack timeline
   • DThe facility field, to identify the source application
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A junior administrator is configuring a new firewall to send logs to the company's existing syslog server at 10.0.0.10. The administrator has set the server IP address and the protocol to UDP. What additional critical piece of information must be configured on the firewall to ensure the syslog server receives the messages?

   • AThe destination port, which should be set to 514
   • BThe facility level, which should be set to 'auth'
   • CThe hostname of the syslog server
   • DThe severity level, which should be set to 'warning'
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which syslog severity level indicates the most critical condition?

   • ADebug (severity 7)
   • BInformational (severity 6)
   • CWarning (severity 4)
   • DEmergency (severity 0)
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company is deploying a new security monitoring solution. The solution requires a central repository to collect and analyze logs from all network devices, including firewalls, switches, and servers. The company wants to use a standard, widely-supported protocol for this purpose. Which protocol should the company choose?

   • ASNMP (Simple Network Management Protocol)
   • BSyslog
   • CNetFlow
   • DSMTP (Simple Mail Transfer Protocol)
   Reveal Solution Discussion Select an answer first