220-1101 Question 94
Single answerSyslogA technician is asked to centralize event logs from several managed switches and Linux servers so the IT team can review security and connectivity issues from one console. The existing devices already support Syslog. Which action should the technician take FIRST to meet this requirement?
- A
Configure each device to forward log messages to the IP address of a centralized Syslog server
- B
Enable SNMP traps on each device and use them instead of Syslog for all logging
- C
Map a shared network drive on each device so log files can be copied to it automatically
- D
Install a local antivirus agent on each device to collect and aggregate event logs
Show answer and explanation
Correct answer: A
Explanation
Syslog is a standard logging method commonly used by routers, switches, firewalls, and Unix/Linux systems to send event messages to a centralized server. In a practical support scenario, the technician should point each device to the centralized Syslog server so logs can be collected in one place for analysis. This aligns with common vendor documentation and best practices for centralized logging. SNMP traps are useful for monitoring and alerting, but they do not provide the same function as full Syslog event collection. Shared drives and antivirus tools are not standard solutions for centralized Syslog management. On the A+ Core 1 exam, candidates should recognize Syslog as a centralized logging solution used for infrastructure and system event review.
- A. Correct.
Correct. Syslog is designed to send log messages from network devices and Unix/Linux systems to a centralized logging server for monitoring and troubleshooting. In a real environment, the first step is to configure each supported device with the destination IP address or hostname of the Syslog server so events can be forwarded to a single console.
- B. Incorrect.
Incorrect. SNMP traps can send alert-style notifications, but they are not a replacement for Syslog-based centralized event logging. A candidate might choose this because SNMP is also used for monitoring network devices, but traps typically provide limited event notification rather than the broader log collection and historical analysis provided by Syslog.
- C. Incorrect.
Incorrect. Copying log files to a shared drive is not the normal or efficient method for centralized Syslog collection, and many managed switches would not support this workflow. This distractor reflects a common misconception that any centralized file storage is equivalent to centralized logging. It does not provide the real-time event forwarding typically expected from Syslog.
- D. Incorrect.
Incorrect. Antivirus agents are intended for malware protection, not for standard cross-platform Syslog aggregation from switches and Linux systems. Someone might select this if they confuse endpoint security management with log management, but antivirus software does not replace a Syslog server.