Which Component Compresses Cisco ASA Cloud Logging Events?

350-701 By islever Editorial Last updated

Short answer

D The SDC VM must be configured because its Security Event Connector compresses ASA syslog and NSEL events before they are sent to the Cisco cloud.

Question

An engineer is configuring cloud logging on Cisco ASA and needs events to compress. Which component must be configured to accomplish this goal?
  1. Cisco analytics
  2. CDO event viewer
  3. SWC service
  4. SDC VM Correct Answer

Key Takeaways

Tests the Cisco Security Analytics and Logging (SAL) architecture; the trap is confusing the compression function with cloud analytics or the SWC service.

Cisco ASA cloud logging uses the on-premises SDC VM to compress syslog and NSEL events before sending them to the Cisco cloud. This page confirms the SDC VM is the correct component (D) and explains why alternatives like SWC service and CDO event viewer are wrong.

Common mistake: Selecting SWC service because its name suggests it handles log compression, but the official ASA-to-cloud flow places compression in the Security Event Connector on the SDC VM.

Expert Analysis

Why the Answer Is Correct

The Secure Device Connector (SDC) VM hosts the Security Event Connector (SEC), which receives syslog and NSEL events from the Cisco ASA, compresses them, and securely forwards them to the Cisco cloud Eventing Service. The official Cisco ASA and SAL integration guide's "ASA Event Flow in SAL" chapter confirms that compression occurs at the SEC on the SDC VM. Therefore, configuring the SDC VM is required to accomplish the goal of compressing events for cloud logging. Since the question asks which component must be configured, the SDC VM is the correct choice (D).

Why the Other Options Are Wrong

Cisco analytics (A) is the cloud-based analytics service where events are ultimately analyzed, not the on-premises component that compresses them. The CDO event viewer (B) is a user interface within Cisco Defense Orchestrator for viewing events; it does not perform compression. The SWC service (C) is sometimes mistakenly associated with log compression, but official SAL documentation places compression in the SEC component of the SDC VM, not in SWC. None of these alternatives match the documented ASA-to-cloud event flow.

Community Comment Notes

As aa4a63c explained, ASA sends events to "the SEC component of the SDC VM" which then compresses them before secure transfer to the Cisco cloud. klu16 pointed to the official Cisco integration guide and specifically the "ASA Event Flow in SAL" chapter for confirmation. dorf05 claimed SWC is used for compressing logs, but that contradicts the documented flow and the overwhelming vote consensus. The community's strong majority for D aligns with the vendor documentation.

Official Reference

https://www.cisco.com/c/en/us/td/docs/security/asa/special/sal-saas/cisco-asa-and-cisco-security-analytics-and-logging-asdm-integration-guide.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

Memorize the SAL event flow: ASA sends syslog and NSEL to the SEC on the SDC VM, which compresses and forwards to the cloud. In exam questions, compression is performed by the on-premises SDC VM, not by cloud services or UI viewers.

Frequently Asked Questions

Why does the SDC VM compress ASA events instead of the CDO event viewer?

The SDC VM hosts the Security Event Connector (SEC), which receives ASA syslog and NSEL events, compresses them, and forwards them to the Cisco cloud; the CDO event viewer only displays events.

Is the SWC service ever responsible for compressing logs in Cisco SAL?

No. Official SAL documentation shows the on-premises SDC VM's Security Event Connector performs compression; SWC is not the configured compression component for ASA cloud logging.

More 350-701 FAQ →

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 6 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 6

  1. klu16 👍 3 Answered D
    https://www.cisco.com/c/en/us/td/docs/security/asa/special/sal-saas/cisco-asa-and-cisco-security-analytics-and-logging-asdm-integration-guide.html Refer to the chapter: ASA Event Flow in SAL
  2. aa4a63c 👍 1 Answered D
    ASA sends events (syslog and NSEL events) to the SEC component of the SDC VM that is configured in CDO. The SEC accepts both TCP and UDP syslogs from ASA and compresses the events. From here on, the events are securely transferred to the Cisco cloud. The SEC sends the compressed events to the cloud-based Eventing Service
  3. dfb0b7d 👍 1 Answered D
    https://www.cisco.com/c/en/us/td/docs/security/asa/special/sal-saas/cisco-asa-and-cisco-security-analytics-and-logging-asdm-integration-guide.html
  4. Surfside92 👍 1 Answered D
    The on-premises SDC is a virtual appliance installed on a hypervisor in your network.
  5. dorf05 👍 1 Answered C
    SWC is use for compressing logs before it sent to the cloud.
Show 1 more comment
  1. ITPro21 👍 1 Answered D
    CDC Compresses SWC Parses

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

What Is a Feature of an Endpoint Detection and Response Solution?

S-grade

Which Two Methods Belong in an AAA Authentication Method List?

S-grade

Preventing Unauthorized DHCP Servers on Cisco Switches

S-grade

What Is Considered a Cloud Data Breach in Cisco 350-701?

S-grade

← Back to 350-701 Study Guide