easyMultiple Choice
CAS-004 Practice Question: Implementing a SIEM solution and needs to ensure…
A company is implementing a SIEM solution and needs to ensure that logs from network devices, servers, and endpoints are collected in a consistent format. Which protocol should be used to transport logs securely?
⚠ Common exam trap
A common mix-up: candidates confuse secure transport with secure log collection; candidates might pick SFTP because it is secure, but it is not designed for real-time log streaming, or they might pick SNMP traps because they are used for network device alerts, but they are not a general log transport protocol.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Syslog over TLS
Syslog over TLS (often called syslog-ng or rsyslog with TLS) is the correct choice because it provides a standardized method to transport syslog messages securely over the network. Syslog itself is the de facto standard for log collection from network devices, servers, and endpoints, and adding TLS ensures confidentiality and integrity during transmission. This meets the requirement for consistent log format (syslog) and secure transport (TLS).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Syslog over UDP
Why it's wrong here
Syslog over UDP is unencrypted and connectionless, so datagrams can be dropped or spoofed, failing the secure transport requirement. It is tempting because syslog is the standard log format for network devices. TLS-encapsulated syslog is correct when confidentiality and integrity are required.
- ✓
Syslog over TLS
Why this is correct
Syslog over TLS encrypts log transport on port 6514, satisfying the requirement to move logs securely while preserving the standard syslog message format that network devices, servers and endpoints already emit, so the SIEM ingests consistent records without proprietary agents.
- ✗
SFTP
Why it's wrong here
SFTP transfers files on demand over SSH; it provides no continuous real-time event streaming, so logs arrive only when a transfer is triggered. It is tempting because it encrypts data in transit. Syslog over TLS is correct for streaming device, server and endpoint events into a SIEM.
- ✗
SNMP traps
Why it's wrong here
SNMP traps are asynchronous alert notifications carrying MIB object values, not a log transport mechanism, and SNMPv3 is needed for security. They are tempting because network devices emit them natively. Syslog over TLS is correct when full event logs must reach the SIEM securely.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 973 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.