Cisco Certified Internetwork Expert (CCIE) Practice Test

Which two commands would enable secure logging on a Cisco ASA to a syslog at 10.0.0.1? (Choose two)

1. Logging host inside 10.0.0.1 TCP/1470 secure

2. Logging host inside 10.0.0.1 UDP/447 secure

3. Logging host inside 10.0.0.1 TCP/1500 secure

4. Logging host inside 10.0.0.1 UDP/514 secure

The correct answer is: Logging host inside 10.0.0.1 TCP/1470 secure

To enable secure logging on a Cisco ASA to a syslog at the specified IP address of 10.0.0.1, one must utilize the correct command syntax and protocols. The command utilizes either TCP or UDP for logging, while also incorporating the 'secure' keyword to indicate that the logging should occur over a secure transport mechanism. The command that employs TCP is a valid choice because it emphasizes a secure connection that ensures reliable delivery of log messages. Using TCP for syslog is preferred in environments where message integrity and delivery is critical, as TCP includes mechanisms for retransmission and guarantees that all messages arrive at their destination without loss. The command that specifies UDP on port 514 is also a common syslog command as UDP is widely used for syslog messages. However, it is important to note that while UDP is the traditional protocol for syslog, the standard port (514) does not incorporate a secure transport mechanism inherently, which makes it less suitable when the objective is to enable secure logging. Overall, utilizing the TCP protocol with the appropriate port ensures not only the secure transmission of log data but also potentially offers better performance with reduced packet loss, which is critical in a network security context.