Cisco Certified Internetwork Expert (CCIE) Practice Test

Which two statements about NetFlow Secure Event logging on a Cisco ASA are true?

1. It is supported only in single context mode

2. It can log different event types on the same device to different collectors

3. It tracks configured collections over TCP

4. It supports one event type per collector

The correct answer is: It can log different event types on the same device to different collectors

The selection of the statement regarding the ability to log different event types on the same device to different collectors is accurate due to the flexible implementation of NetFlow Secure Event Logging (NSEL) on a Cisco ASA. This feature allows network administrators to configure multiple event types and direct them to various collectors, enabling streamlined log management and more effective analysis. This capability is particularly beneficial for organizations that need to segregate logs based on their use cases or for compliance with varying regulatory requirements. The other statements do not accurately reflect the capabilities of NSEL. For instance, the assertion that it is supported only in single context mode is not correct; NSEL can function in both single and multi-context modes. Moreover, the fact that it tracks configured collections over TCP is misleading since NetFlow packets, including event logs, are typically transmitted over UDP, though TCP can be used for specific configurations. Lastly, the point about supporting one event type per collector overlooks NSEL's design that allows the aggregation of different event types to a single collector, enhancing its utility in modern network management scenarios.