6.5 Explain the Function of Syslog CYBERSECURITY-APPRENTICE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A company is setting up a centralized log management system. They need to ensure that syslog messages containing sensitive security data are not readable by an attacker who might be sniffing network traffic. The network team has confirmed that all devices support the necessary protocols. Which transport configuration should be used to meet this requirement?

   • ASend messages over UDP port 514 to the central collector
   • BSend messages over TCP port 1468 to the central collector
   • CSend messages over UDP port 514 with a custom encryption header
   • DSend messages over TLS to the central collector on port 6514
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A small company has 15 network devices, including routers, switches, and firewalls. The IT manager wants to simplify log management and improve security monitoring by having a single place to review logs from all devices. What is the most effective approach to achieve this?

   • AManually review logs on each device by connecting to its console
   • BUse a spreadsheet to manually copy log entries from each device daily
   • CConfigure each device to send its logs to a central syslog server
   • DStore logs locally on each device and only retrieve them during an incident
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A network administrator is configuring a router to send syslog messages to a central server. The administrator is concerned about the potential for messages to be lost if the network is congested. Which syslog transport protocol should the administrator choose to ensure reliable delivery?

   • ATCP (Transmission Control Protocol)
   • BUDP (User Datagram Protocol)
   • CICMP (Internet Control Message Protocol)
   • DARP (Address Resolution Protocol)
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which transport protocol and port are traditionally used for syslog message transmission?

   • AUDP port 161
   • BTCP port 443
   • CUDP port 514
   • DTCP port 22
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   How does syslog contribute to security monitoring in a SOC?

   • AIt automatically blocks malicious IP addresses
   • BIt replaces the need for a SIEM system
   • CIt provides a centralized stream of event data that can be analyzed for suspicious activity
   • DIt encrypts all network traffic to prevent attacks
   Reveal Solution Discussion Select an answer first