Global Solutions Inc. uses syslog for centralized logging across a geographically diverse network. The SOC team must ensure logs are reliably delivered from remote sites to the central logging…

Question

Options

• ASyslog application layer
• BSyslog management and filtering
• CSyslog content layer
• DSyslog transport layer

• A
  5% (1)
• B
  5% (1)
• C
  11% (2)
• D
  79% (15)

Explanation

Reliable delivery across unreliable networks is primarily a transport-layer concern. The syslog transport layer covers how messages are transmitted between devices, relays, and collectors, including protocol choice and delivery assurance. Many syslog deployments default to UDP for simplicity, but UDP is lossy and does not guarantee delivery-problematic for remote sites and compliance-driven logging. Hardening transport typically involves using TCP (reliable delivery), TLS for encryption and integrity, buffering/queueing at relays, retransmission handling, and monitoring of connection health and backlog. The content layer is about message format and fields; management and filtering is about routing and reduction of noise; application layer relates to the syslog-generating and receiving software. Those are important, but they do not address the fundamental need for dependable delivery under network instability. From a SOC perspective, transport reliability directly impacts forensic completeness, alert accuracy, and compliance evidence.

No community discussion yet for this question.