3.4 Recommend Strata Logging Service Log Forwarding Methods and Integrations (e.g., Syslog over TLS, HTTP, Email) NETWORK-SECURITY-ARCHITECT Practice Questions (Page 5)

Questions 21–24

1. 21foundation · easy

   What is the primary purpose of the Strata Logging Service log forwarding feature?

   • ATo encrypt logs at rest within the firewall's internal storage
   • BTo send firewall logs to external destinations such as SIEMs, syslog servers, or email for analysis and alerting
   • CTo synchronize firewall configurations across multiple devices
   • DTo replace the firewall's local storage with a cloud-based log repository
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A company is configuring SLS HTTP forwarding to a SIEM. The SIEM requires logs to be sent to a specific API endpoint with a custom header for authentication. The forwarding profile is configured with the correct URL and the custom header, but the SIEM is not receiving logs. The firewall shows the profile as 'connected'. What is the most likely cause?

   • AThe custom header is not being sent because SLS HTTP forwarding does not support custom headers.
   • BThe SIEM's API endpoint is rejecting the logs due to an invalid URL.
   • CThe SIEM's certificate is not trusted by the firewall.
   • DThe firewall's data plane is not passing the HTTP requests.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A large enterprise is evaluating SLS forwarding methods for two use cases: (1) real-time threat detection in a SIEM that only accepts syslog, and (2) automated enrichment of threat intelligence in a cloud platform that only accepts HTTPS REST API calls. The architect must select a single forwarding method that satisfies both use cases. What should the architect recommend?

   • AConfigure syslog over TLS forwarding to both the SIEM and the cloud platform.
   • BConfigure email forwarding to both the SIEM and the cloud platform.
   • CConfigure two separate forwarding profiles: syslog over TLS for the SIEM and HTTP for the cloud platform.
   • DConfigure HTTP forwarding to the SIEM and the cloud platform, since HTTP can deliver to both.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A company configured SLS HTTP forwarding to a SIEM. The SIEM is receiving logs, but the logs are not being parsed correctly; the SIEM shows 'unknown format' errors. The forwarding profile shows 'connected' and there are no authentication errors. What is the most likely cause of the parsing failure?

   • AThe SIEM's certificate is not trusted by the firewall.
   • BThe SIEM's API endpoint is rejecting the logs due to an invalid token.
   • CThe firewall's data plane is dropping the HTTP requests.
   • DThe log format configured in the forwarding profile does not match the SIEM's expected schema.
   Reveal Solution Discussion Select an answer first