Which Component Compresses Cisco ASA Cloud Logging Events?
An engineer is configuring cloud logging on Cisco ASA and needs events to compress. Which component must be configured to accomplish this goal?
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
Tests the Cisco Security Analytics and Logging (SAL) architecture; the trap is confusing the compression function with cloud analytics or the SWC service.
Cisco ASA cloud logging uses the on-premises SDC VM to compress syslog and NSEL events before sending them to the Cisco cloud. This page confirms the SDC VM is the correct component (D) and explains why alternatives like SWC service and CDO event viewer are wrong.
Selecting SWC service because its name suggests it handles log compression, but the official ASA-to-cloud flow places compression in the Security Event Connector on the SDC VM.
Community Discussion (6 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The Secure Device Connector (SDC) VM hosts the Security Event Connector (SEC), which receives syslog and NSEL events from the Cisco ASA, compresses them, and securely forwards them to the Cisco cloud Eventing Service. The official Cisco ASA and SAL integration guide's "ASA Event Flow in SAL" chapter confirms that compression occurs at the SEC on the SDC VM. Therefore, configuring the SDC VM is required to accomplish the goal of compressing events for cloud logging. Since the question asks which component must be configured, the SDC VM is the correct choice (D).Why the Other Options Are Wrong
Cisco analytics (A) is the cloud-based analytics service where events are ultimately analyzed, not the on-premises component that compresses them. The CDO event viewer (B) is a user interface within Cisco Defense Orchestrator for viewing events; it does not perform compression. The SWC service (C) is sometimes mistakenly associated with log compression, but official SAL documentation places compression in the SEC component of the SDC VM, not in SWC. None of these alternatives match the documented ASA-to-cloud event flow.Community Comment Notes
As aa4a63c explained, ASA sends events to "the SEC component of the SDC VM" which then compresses them before secure transfer to the Cisco cloud. klu16 pointed to the official Cisco integration guide and specifically the "ASA Event Flow in SAL" chapter for confirmation. dorf05 claimed SWC is used for compressing logs, but that contradicts the documented flow and the overwhelming vote consensus. The community's strong majority for D aligns with the vendor documentation.Official Reference
Exam Strategy
Memorize the SAL event flow: ASA sends syslog and NSEL to the SEC on the SDC VM, which compresses and forwards to the cloud. In exam questions, compression is performed by the on-premises SDC VM, not by cloud services or UI viewers.
Frequently Asked Questions
Why does the SDC VM compress ASA events instead of the CDO event viewer?
The SDC VM hosts the Security Event Connector (SEC), which receives ASA syslog and NSEL events, compresses them, and forwards them to the Cisco cloud; the CDO event viewer only displays events.
Is the SWC service ever responsible for compressing logs in Cisco SAL?
No. Official SAL documentation shows the on-premises SDC VM's Security Event Connector performs compression; SWC is not the configured compression component for ASA cloud logging.