easyMultiple SelectObjective-mapped
200-201 Practice Question: Which TWO of the following are best practices for…
Which TWO of the following are best practices for configuring syslog in a secure monitoring environment? (Choose two.)
⚠ Common exam trap
Cisco often tests the misconception that changing default ports or using UDP provides security, when in fact these practices do not address real threats like interception or data loss.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure a maximum log file size to prevent disk exhaustion
Configuring a maximum log file size prevents syslog messages from filling up the disk, which could cause the system to crash or become unresponsive. This is a critical best practice in secure monitoring to ensure logging continues without exhausting storage resources.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use UDP as the transport protocol to ensure reliable delivery
Why it's wrong here
UDP is unreliable; TCP or TLS should be used for important logs.
- ✗
Set log files to overwrite daily
Why it's wrong here
Overwriting daily may delete logs needed for compliance or forensic analysis.
- ✓
Configure a maximum log file size to prevent disk exhaustion
Why this is correct
Limiting log size prevents denial of service due to full disk.
- ✗
Change the default syslog port to avoid detection by attackers
Why it's wrong here
Security through obscurity is not effective; use encryption instead.
- ✓
Send syslog messages to a centralized log server over a dedicated management network
Why this is correct
Isolating syslog traffic enhances security and reliability.
Go deeper
Related to this question
About these practice questions
One of 979 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 200-201
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO of the following are best practices for configuring syslog to ensure reliable security event logging?
medium- A.Use UDP for faster transmission and lower overhead.
- B.Enable debug-level logging for all devices to capture maximum detail.
- C.Disable log filtering to ensure all messages are sent.
- ✓ D.Use TCP (port 514) instead of UDP for log transmission.
- ✓ E.Configure syslog to send logs to at least two different servers.
Why D: Syslog over TCP (port 514) provides reliable, connection-oriented delivery, ensuring that log messages are not lost during transmission. Unlike UDP, TCP includes acknowledgment and retransmission mechanisms, which are critical for security event logging where message integrity and completeness are paramount.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.