Exam JN0-230 topic 1 question 45 discussion

Correct answer is Stream Mode From FW : "The security log is configured in stream mode The session logs are sent directly to the log collector and cannot be locally stored. Please set the log mode to 'Event' to use the page. Note:When event mode is enabled, the sream mode configuration will be deleted. The stream mode functionality that is available under Monitor >like Events,Reports is not functional."

depends on version. before 15.1X49-D90 should be event mode and aftter this version on stream mode. I belive tat teh question is reffering to old version - event mode https://kb.juniper.net/InfoCenter/index?page=content&id=KB32479&cat=SRX_SERIES&actp=LIST

The data plane logs, also called security logs, primarily include security events that are handled inside the data plane. Security logs can be in text or binary format, and they can be saved locally (event mode) or sent to an external server (stream mode). Binary format is required for stream mode and recommended to conserve log space in event mode. https://www.juniper.net/documentation/us/en/software/junos/network-mgmt/topics/topic-map/system-logging-for-a-security-device.html

Real SRX says: "TRAFFIC LOGGING NOT ENABLED IN STREAM MODE. Currently logging is not enabled. To view data, configure Stream Mode - Configure > Device Settings > Basic Settings > Security Logging". So it's "C"

I think the correct is D. the stream mode usef to send log to remote server

C is the right choice!

It is actually stream mode after a certain version.

Thanks for your help but the correct answer is: "C"

correct: D . You must enable event mode security logging on the SRX Series device.