300-620 · Question #263
An engineer must implement user activity tracking in the Cisco ACI with a solution that meets these requirements: - All user activity that is related to the Cisco ACI infrastructure hardware must be…
The correct answer is C. Create a Syslog Monitoring Destination Group with a remote destination of the SIEM device. Fabric > Fabric > Policies > Monitoring > default > Callhome/Smart Callhome/SNMP/Syslog/TACACs uni/fabric/monfab-default Create Syslog Source Provide a name for this source (i.e., FabricDefaultSyslog) Select the Minimum Syslog Severity Level (default is warning; we have changed…
Question
An engineer must implement user activity tracking in the Cisco ACI with a solution that meets these requirements:
- All user activity that is related to the Cisco ACI infrastructure
hardware must be tracked.
- All audit logs with severity level 5 and below must be collected and
exported.
- Logs must be exported to a Security Information and Event Management
(SIEM) appliance. Which set of steps must be taken?
Options
- ACreate a Syslog Monitoring Destination Group with a remote destination of the SIEM device.
- BCreate a Syslog Monitoring Destination Group with a Local File destination.
- CCreate a Syslog Monitoring Destination Group with a remote destination of the SIEM device.
- DCreate a Syslog Monitoring Destination Group with Console Destination.
How the community answered
(25 responses)- A4% (1)
- B4% (1)
- C84% (21)
- D8% (2)
Explanation
Fabric > Fabric > Policies > Monitoring > default > Callhome/Smart Callhome/SNMP/Syslog/TACACs uni/fabric/monfab-default Create Syslog Source Provide a name for this source (i.e., FabricDefaultSyslog) Select the Minimum Syslog Severity Level (default is warning; we have changed this to Select the categories of messages to source (default is faults; we have selected all categories) Select the Destination Syslog Server (this is the server we previously defined) https://unofficialaciguide.com/2018/08/11/configuring-syslog-for-aci/
Topics
Community Discussion
No community discussion yet for this question.