Resolving On-Premises Logging Gaps in Cisco Stealthwatch Cloud
Describe security monitoring and telemetry technologies
Answer
Correct answer: B — Deploy a Cisco Stealthwatch Cloud sensor on the network to send data to Cisco Stealthwatch Cloud.
An organization has a Cisco Stealthwatch Cloud deployment in their environment. Cloud logging is working as expected, but logs are not being received from the on-premise network. What action will resolve this issue?
Community Insight
It tests the understanding that while the cloud platform handles analysis, a local sensor is required to collect and forward data from isolated on-premise environments.
This question addresses the architecture of Cisco Stealthwatch Cloud for monitoring private networks, specifically how to ingest telemetry from on-premise sources that cannot reach the cloud directly.
Many candidates incorrectly choose Option D (NetFlow), assuming that appliances can send NetFlow directly to the cloud. In reality, direct NetFlow ingestion to the cloud console is not supported for on-premise sources; a local sensor must act as the collector.
Community Discussion (14 comments)
XBfoundX
👍 1
Selected: B
B is the correct one as many mentioned: . It is the perfect solution for organizations that want better awareness and security within their on-premises environments while reducing capital expenditure and operational overhead. It works by deploying a lightweight appliance, referred to as the Stealthwatch Cloud Sensor, in a virtual machine or server that can consume a variety of native sources of telemetry or extract metadata from network packet flow. It encrypts this metadata and sends it to the Stealthwatch Cloud analytics platform for analysis. Stealthwatch Cloud consumes metadata only.
CyberGhost666
👍 1
Selected: B
B is correct
EMoshi
👍 1
Selected: B
true based on the link https://www.cisco.com/c/dam/en/us/products/collateral/security/stealthwatch-cloud/sw-cloud-sensor-performance-wp.pdf
kloug
👍 1
Answer b
4pelos
👍 1
Correct answer B. Checked in securitytut
Stevens0103
👍 3
Selected: B
https://www.cisco.com/c/dam/en/us/products/collateral/security/stealthwatch-cloud/sw-cloud-sensor-performance-wp.pdf
ums008
👍 3
Selected: D
I agree with some people who have already raised this concern, Correct Answer is D To resolve the issue of logs not being received from the on-premise network in a Cisco Stealthwatch Cloud deployment, the organization should configure their security appliances to send NetFlow data to Cisco Stealthwatch Cloud. NetFlow is a network protocol that provides visibility into network traffic flows. Option B, deploying a Cisco Stealthwatch Cloud sensor on the network to send data to Cisco Stealthwatch Cloud, is not the appropriate action to resolve this issue. Cisco Stealthwatch Cloud sensors are not deployed on the network itself but rely on data received from network devices, such as routers or switches, through protocols like NetFlow.
Stevens0103
👍 4
The answer is B. Check this out: https://www.cisco.com/c/dam/en/us/products/collateral/security/stealthwatch-cloud/sw-cloud-sensor-performance-wp.pdf "Cisco Stealthwatch Cloud Private Network...is the perfect solution for organizations that want better awareness and security within their on-premises environments while reducing capital expenditure and operational overhead. It works by deploying a lightweight appliance, referred to as the Stealthwatch Cloud Sensor, in a virtual machine or server that can consume a variety of native sources of telemetry or extract metadata from network packet flow. It encrypts this metadata and sends it to the Stealthwatch Cloud analytics platform for analysis. Stealthwatch Cloud consumes metadata only. The packet payloads are never retained or transferred outside the network."
ddev3737_111
👍 2
B is right
ddev3737_111
👍 1
I might be wrong, this is the info I have from the document= Stealthwatch Cloud Sensor for Private Network Monitoring In order to monitor on-premises networks, a Stealthwatch Cloud Sensor appliance will need to be installed. This appliance can be installed either as a physical appliance or as a virtual machine leveraging the ISO or OVF distributions. Conceptually, the figure below illustrates the deployment scenario of the Stealthwatch Cloud Sensor, where the on-premises sensor collects telemetry and forwards metadata to the customer’s Stealthwatch Cloud instance through an encrypted private tunnel.
ddev3737_111
👍 1
B could be incorrect because deploying a Cisco Stealthwatch Cloud sensor on the network to send data to Cisco Stealthwatch Cloud is not necessary. According to the scenario, the problem is that logs are not being received from the on-premise network, but adding a new sensor in the same network will not resolve the issue. The correct solution is to configure security appliances to send syslogs or NetFlow to Cisco Stealthwatch Cloud, which will allow logs to be received and analyzed.
Dorr20
👍 2
Logs from the Cloud are working. Logs from the On-Prem are not. Install a sensor on-prem to send the files. Netflows should be sent to the sensor, not directly to the cloud
ic0deem
👍 12
B is correct. https://www.cisco.com/c/dam/en/us/products/collateral/security/stealthwatch-cloud/sw-cloud-sensor-performance-wp.pdf
Edy79
👍 2
I agree with B: Stealthwatch Cloud Sensor for Private Network Monitoring In order to monitor on-premises networks, a Stealthwatch Cloud Sensor appliance will need to be installed.
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The correct action is to deploy a Cisco Stealthwatch Cloud Sensor on the on-premise network (Option B). According to Cisco's architecture documentation, the Stealthwatch Cloud platform relies on a 'Cloud Sensor' appliance installed within the private network to collect flow data, syslog, and other telemetry from local security devices. This local sensor then securely forwards the aggregated data to the cloud instance for analysis.Why the Other Options Are Wrong
Option A is incorrect because an FTD sensor is primarily used for firewall logs and does not inherently solve the collection gap for general network flows without specific configuration, whereas the dedicated Sensor is the standard component for this role. Option C is incorrect because security appliances generally do not send raw syslogs directly to the cloud console; they send them to the local sensor. Option D is the most common distractor; while NetFlow is the primary data type collected, it must be sent to the local Sensor first, not directly to the Cloud API/Console.Community Comment Notes
The community consensus strongly favors Option B. As noted by user ic0deem and Stevens0103, Cisco's official whitepaper on Stealthwatch Cloud performance confirms that organizations deploying this solution for on-premise awareness require a deployed sensor appliance. User Dorr2737 further clarifies that netflows should be sent to the sensor, not directly to the cloud, reinforcing the architectural boundary.Official Reference
Exam Strategy
When studying Cisco Secure Network Analytics or Stealthwatch, distinguish between the Cloud Management plane and the Local Data Collection plane. Always identify if the source is 'on-premise'; if so, look for the 'Sensor' or 'Collector' option rather than direct cloud connectivity.
Frequently Asked Questions
Can security appliances send NetFlow directly to Stealthwatch Cloud?
No. On-premise appliances must send NetFlow to a locally deployed Stealthwatch Cloud Sensor, which then forwards it to the cloud.
What is the role of the Stealthwatch Cloud Sensor?
It acts as a local collector for flow, syslog, and event data from on-premise devices, bridging the private network to the cloud analytics engine.