Firewall syslog messages contain usernames and internal addresses, and they cross an untrusted transit network to reach a SIEM. Currently they are sent in clear text over UDP 514. Which change protects these messages in transit?
Select an answer to reveal the explanation.
Short Explanation
Plain syslog is a postcard: anyone who handles it can read it. Wrapping it in TLS turns that postcard into a sealed, signed envelope. Watch the trap where TCP alone looks like the fix; reliable delivery gives you guaranteed arrival, not privacy.
Full Explanation
Traditional syslog uses UDP without any confidentiality or integrity protection, so anyone on the path can read or alter messages. Syslog over TLS, standardized in RFC 5425, runs the stream over TCP inside a TLS session: the sender verifies the collector's certificate, the payload is encrypted, and tampering is detected. That directly addresses sensitive content crossing an untrusted network. Moving to TCP without TLS adds ordered, acknowledged delivery and avoids silent loss, but the bytes remain readable, so the confidentiality problem is untouched. Raising the logging threshold to emergencies would suppress almost every useful message, crippling detection and audit; reducing visibility is not an acceptable substitute for protecting the channel. Sending duplicates to a second collector improves availability but doubles the exposure, since both copies travel unencrypted. Exam caveat: secure syslog depends on certificate trust, so the device must trust the CA that issued the collector certificate, and a broken or expired certificate stops logging, which should itself be monitored. Operational check: enable TLS on the logging host definition, install the collector CA as trusted, confirm the session establishes, capture traffic to verify no readable log text crosses the transit network, and check the SIEM for continuous arrival of events.