3.4 Recommend Strata Logging Service Log Forwarding Methods and Integrations (e.g., Syslog over TLS, HTTP, Email) NETWORK-SECURITY-ARCHITECT Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is a common cause of syslog over TLS forwarding failure?

   • AIncorrect log format
   • BUntrusted or expired server certificate
   • CMissing API token
   • DIncorrect SMTP server port
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company configured SLS HTTP forwarding to a third-party SIEM. The SIEM is not receiving logs, and the firewall shows the forwarding profile as 'failed'. The architect checks the firewall's system logs and sees an HTTP 401 response from the SIEM endpoint. What is the most likely cause?

   • AThe SIEM endpoint URL is unreachable from the firewall.
   • BThe API key or authentication token configured in the forwarding profile is invalid or expired.
   • CThe firewall's data plane is not passing traffic.
   • DThe log format is not compatible with the SIEM's parser.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which of the following is a supported destination for Strata Logging Service log forwarding?

   • AA Panorama management server
   • BAn HTTP API endpoint
   • CA syslog server over UDP
   • DA local USB drive attached to the firewall
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A government agency requires that all log forwarding from SLS be encrypted in transit and that the destination server be authenticated. The agency's log collector supports syslog over TLS. What must the architect configure on the firewall to meet the authentication requirement?

   • ADisable certificate validation on the firewall to allow the connection.
   • BConfigure the firewall to use a pre-shared key for the syslog connection.
   • CUpload the log collector's CA certificate to the firewall's trusted CA list.
   • DGenerate a client certificate on the firewall and upload it to the log collector.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A hospital network forwards SLS logs to a central syslog server over TLS. After a recent upgrade, the syslog server's certificate was replaced with a new certificate signed by a different internal CA. The firewall now shows the forwarding profile as 'failed' with a TLS error. What is the most likely cause and the correct remediation?

   • AThe new CA certificate is not trusted by the firewall; upload the new CA certificate to the firewall's trusted CA list.
   • BThe firewall's own certificate expired; generate a new certificate for the firewall.
   • CThe syslog server is now using TLS 1.3; configure the firewall to use TLS 1.3.
   • DThe syslog server's IP address changed; update the forwarding profile with the new IP address.
   Reveal Solution Discussion Select an answer first