Exam 300-710 topic 1 question 158 discussion

A. From attended Cisco training. Connection to SIEM, Security in FMC.

From Cisco Official course : If you need to log all traffic information for compliance, you can uncheck Firewall Management Center as a logging destination and just leave the Syslog Server option. This configuration will free up a lot of resources on the FMC as the syslog is being generated directly from the managed device.

This probably confirms the answer A The FMC can log some syslogs. However, it does not have adequate storage provision to accommodate voluminous information from connection events. https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/710/management-center-device-config-71/interfaces-settings-platform.html#task_88952FB807AB4D43B0894F99B215EDD4:~:text=The%20FMC%20can%20log%20some%20syslogs.%20However%2C%20it%20does%20not%20have%20adequate%20storage%20provision%20to%20accommodate%20voluminous%20information%20from%20connection%20events

my answer is "D". FTD events should be delivered to FMC first and forward to SIEM. so FMC can do analysis itself first before any information is forwarded. FMC storage data can be purged due to a limited storage space. we are using Splunk forwarder as SIEM. FMC is receiving all event and security incidents and forwarding to Splunk for further analysis.

A does not make any sense to me, the SIEM would have duplicate logs. You can configure FTD to send the ACP logs directly via syslog. https://www.youtube.com/watch?v=GjKavkRbUVg

I think A is the best practices. https://panenka.sk/cisco-fmc-ftd-eventing/#:~:text=FTD%20firewall%20will%20send%20syslogs,still%20delivered%20to%20the%20FMC.