CV0-002 · Question #298
A cloud administrator updates the syslog forwarder configuration on a local server in production to use a different port. The development team is no longer receiving the audit logs from that server…
The correct answer is B. The security team has greater permissions than the development team. The most likely issue is that the security team has elevated permissions allowing them to access logs directly or via a different mechanism, while the development team relies on the modified syslog forwarder.
Question
A cloud administrator updates the syslog forwarder configuration on a local server in production to use a different port. The development team is no longer receiving the audit logs from that server. However, the security team can retrieve and search the logs for the same server. Which of the following is MOST likely the issue?
Options
- AThe development team is not looking at the correct server when querying for the logs.
- BThe security team has greater permissions than the development team.
- CThe audit logging service has been disabled on the server.
- DThe development team's syslog server is configured to listen on the wrong port.
How the community answered
(24 responses)- A4% (1)
- B83% (20)
- C4% (1)
- D8% (2)
Why each option
The most likely issue is that the security team has elevated permissions allowing them to access logs directly or via a different mechanism, while the development team relies on the modified syslog forwarder.
The question states the development team is no longer receiving logs from that server, implying they are looking at the correct source but the data is not arriving.
If the security team can still access logs, they likely have direct access to the server or a central log management system with broader permissions, bypassing the syslog forwarder configuration that the development team relies on. This allows them to retrieve logs even if the forwarder's destination port was changed.
If the audit logging service were disabled, neither the development team nor the security team would be able to retrieve or search logs from that server.
If the development team's syslog server was listening on the wrong port, it would not explain why the security team can still retrieve logs from the server.
Concept tested: Log management access control and troubleshooting
Topics
Community Discussion
No community discussion yet for this question.