A compliance team wants near-real-time firewall events in Splunk for its dashboards. The Management Center sits in a segment that allows only outbound connections, platform policy limits it to Cisco-supported components, and the feed must run continuously. Which Splunk integration method satisfies all three conditions?
Select an answer to reveal the explanation.
Short Explanation
Solid pick — syslog push means the Management Center opens the only outbound connection, so you install nothing extra. It's like the firewall mailing its logbook to Splunk instead of Splunk knocking on the door. The feed keeps streaming and each line carries the full security event your dashboards need.
Full Explanation
Forwarding syslog events from the Management Center to the Splunk indexer fits the network direction: the appliance initiates the permitted outbound connection, and syslog can deliver events continuously for near-real-time indexing. It also avoids installing non-Cisco components on the Management Center, satisfying the platform policy. REST API polling is a legitimate integration pattern and can use supported interfaces, but polling requires Splunk to initiate connections to the Management Center; that conflicts with the segment’s outbound-only rule, even if the polling interval is short. Scheduled CSV report export over SFTP is also a plausible way to move supported event data outward, but it produces periodic batches rather than a continuously running event feed, so dashboards can lag between exports. SNMP traps are useful for sending selected alert notifications to Splunk, but they represent policy-triggered alerts, not a complete stream of firewall events; relying on them would leave ordinary event records out of the dashboards. Exam caveat: “near-real-time” does not mean every supported protocol is an equivalent event feed—check whether it carries the required event scope as well as meeting transport constraints. Practical check: verify outbound routing and firewall rules from the Management Center to the Splunk syslog listener, then confirm representative events arrive continuously with expected timestamps and fields.