1.5 Create and Apply Log Forwarding Profile NETWORK-SECURITY-ANALYST Practice Questions (Page 2)

Questions 6–10

1. 6expert · medium

   A company has a requirement to forward all traffic logs to a SIEM for long-term storage, but only forward threat logs with 'critical' severity to a separate email distribution list for immediate alerting. The administrator has created a Log Forwarding profile. What is the MOST efficient configuration to meet this requirement?

   • AIn the single profile, add a syslog destination for the Traffic log type and an email destination for the Threat log type with a severity filter.
   • BConfigure the email destination for both traffic and threat logs, and set up a separate syslog forwarder on the email server.
   • CConfigure the syslog destination for both traffic and threat logs, and set up a separate email alert on the SIEM for critical threats.
   • DCreate two separate Log Forwarding profiles: one for traffic to syslog and one for critical threats to email, and apply both to the security policy rule.
   Reveal Solution Discussion Select an answer first
2. 7expert · medium

   A firewall administrator is troubleshooting why logs are not being forwarded to a syslog server. The Log Forwarding profile is correctly configured and applied to the security policy rule. The syslog server is reachable from the firewall's management interface. The administrator checks the syslog server profile and notices that the 'Facility' is set to 'LOG_USER' and the 'Severity' is set to 'LOG_INFO'. What is the MOST likely reason logs are not being received?

   • AThe syslog server is configured to only accept logs with a specific facility or severity that does not match the profile.
   • BThe Log Forwarding profile is using the wrong log type.
   • CThe firewall's dataplane is not generating logs for the matched traffic.
   • DThe syslog server profile is not associated with the Log Forwarding profile.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   An administrator has configured a Log Forwarding profile to send traffic logs to a syslog server. After applying the profile to a rule and generating traffic, the syslog server receives logs, but the logs are missing the application name and user information. What is the MOST likely cause?

   • AThe syslog server is configured to parse only a subset of the log fields.
   • BThe traffic was generated by a user who is not part of any user group.
   • CThe Log Forwarding profile is configured to send logs in a format that does not include those fields.
   • DThe security policy rule does not have user identification and application identification enabled.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security team needs to receive email alerts for high-severity threat logs and also forward all traffic logs to a central syslog server. They have created a Log Forwarding profile. How should they configure the profile to meet BOTH requirements?

   • AUse the syslog destination for both threat and traffic logs, and set up a separate email alert on the syslog server.
   • BCreate two separate Log Forwarding profiles: one for email alerts with a threat log filter, and one for syslog with a traffic log type.
   • CIn the single Log Forwarding profile, add an email destination for the threat log type with a severity filter, and add a syslog destination for the traffic log type.
   • DConfigure the email destination in the profile and apply it to the security policy, then configure the syslog destination directly on the security policy rule.
   Reveal Solution Discussion Select an answer first
6. 10expert · medium

   A security team is verifying that a Log Forwarding profile is working correctly. They have generated test traffic that should trigger a threat log and a URL filtering log. The syslog server receives the URL filtering log but NOT the threat log. The Log Forwarding profile has both Threat and URL Filtering log types configured with the same syslog destination. What is the MOST likely cause of the missing threat log?

   • AThe threat log filter in the profile is too restrictive and does not match the generated threat.
   • BThe syslog server is not configured to receive threat logs.
   • CThe URL filtering log type is configured before the threat log type in the profile.
   • DThe security policy rule is not configured to log threats.
   Reveal Solution Discussion Select an answer first