N10-009 Question 212
Single answerLog aggregation: Syslog collector, Security information and event management (SIEM)A network administrator is deploying centralized logging for several routers, switches, and Linux servers. The security team also wants the ability to correlate failed VPN logins from the firewall with suspicious authentication events from servers and generate alerts when patterns match. Which solution BEST meets these requirements?
- A
Configure each device to send syslog messages to a syslog collector only
- B
Deploy a SIEM platform and forward logs from network devices and servers into it
- C
Enable SNMP traps on all devices and use them as the primary logging source
- D
Store logs locally on each device and review them manually during incidents
Show answer and explanation
Correct answer: B
Explanation
The best answer is to deploy a SIEM platform because the scenario requires more than simple log collection. A syslog collector is useful for centralizing syslog messages from infrastructure devices, but a SIEM adds the critical capabilities of aggregation across varied sources, normalization, correlation, alerting, and often dashboards and reporting. In real environments, network devices such as routers, switches, and firewalls commonly forward syslog to a centralized platform, and servers may use agents or native log forwarding to send security events into the same system. This supports detection of multi-stage incidents, such as repeated failed VPN logins followed by suspicious server authentication attempts. Best practices from common vendor documentation and security operations guidance consistently distinguish between basic log collection and SIEM-based security analytics: syslog centralizes transport of log messages, while a SIEM enables cross-source analysis and automated detection.
- A. Incorrect.
A syslog collector centralizes log messages, which improves retention and search compared to local-only logging. However, by itself, a basic syslog collector does not inherently provide the event correlation, analytics, and alerting capabilities typically required to match related events across firewalls, VPN systems, and servers. Someone might choose this because syslog is a standard logging method, but it does not fully satisfy the correlation requirement.
- B. Correct.
A SIEM is designed to ingest logs from multiple sources, normalize and analyze events, correlate activity across systems, and generate alerts based on defined rules or suspicious patterns. This directly addresses the requirement to compare failed VPN logins with server authentication events and alert the security team when related indicators appear together.
- C. Incorrect.
SNMP traps can notify monitoring systems about certain device events, but they are not a replacement for centralized log aggregation and security event correlation. Traps are limited in context compared to full log data and are mainly used for monitoring and fault notification, not as the primary source for security log analysis.
- D. Incorrect.
Keeping logs only on local devices makes investigations slower and less reliable, especially if a device fails or an attacker tampers with local logs. Manual review also does not provide timely correlation or automated alerting across multiple systems, which is a key requirement in this scenario.