Exam 500-220 topic 4 question 52 discussion

I think A is correct: we are logging outbound traffic to Syslog server.

The exhibit shows the syslog server is accessible via AutoVPN (enable means-allowed, disable-deny). If the traffic passes through the site-to-site AutoVPN connection the traffic will then be subject to the 'Site-to-site outbound firewall' rules and as such an allow rule may be required. This can be configured in Security & SD-WAN > Configure > Site-to-site VPN > Organization-wide settings > Add a rule

For one, it's outbound rules. For two, see source below. "Logging: If syslog reporting is enabled, denotes whether or not to report on a given rule." Source: https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Using_Layer_3_Firewall_Rules

The correct is C. The exibit shows an MX Firewall rule and "Logging" option is shown when the "Flows" option is selected on the Syslog server configuration. So the "Logging=enabled" means that this rule is allowed to send data to Syslog. I tested this on my lab. "If the Flows role is enabled for Meraki MX reporting, logging for individual firewall rules can be enabled/disabled on the Security & SD-WAN > Configure > Firewall page, under the Logging column as shown below" Ref: https://documentation.meraki.com/General_Administration/Monitoring_and_Reporting/Meraki_Device_Reporting_-_Syslog%2C_SNMP%2C_and_API

The correct is C. The exibit shows an MX Firewall rule and "Logging" option is shown when the "Flows" option is selected on the Syslog server configuration. So the "Logging=enabled" means that this rule is allowed to send data to Syslog. I tested this on my lab. "If the Flows role is enabled for Meraki MX reporting, logging for individual firewall rules can be enabled/disabled on the Security & SD-WAN > Configure > Firewall page, under the Logging column as shown below" Ref: https://documentation.meraki.com/General_Administration/Monitoring_and_Reporting/Meraki_Device_Reporting_-_Syslog%2C_SNMP%2C_and_API

Correct: A

"Inbound and outbound flows will generate a syslog message showing the source and destination along with port numbers and the firewall rule that they matched. For inbound rules, 1=deny and 0=allow." https://documentation.meraki.com/General_Administration/Monitoring_and_Reporting/Syslog_Server_Overview_and_Configuration Should be A

Should be A - syslog can be configured for both outbound rules and inbound rules. Would like to see the reasoning for D?

Sorry D is correct

Should be A