Which Component Compresses Cisco ASA Cloud Logging Events?

Answer Correct answer: D — The SDC VM must be configured because its Security Event Connector compresses ASA syslog and NSEL events before they are sent to the Cisco cloud.

An engineer is configuring cloud logging on Cisco ASA and needs events to compress. Which component must be configured to accomplish this goal?

  1. Cisco analytics
  2. CDO event viewer
  3. SWC service
  4. SDC VM Correct Answer

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

Tests the Cisco Security Analytics and Logging (SAL) architecture; the trap is confusing the compression function with cloud analytics or the SWC service.

Cisco ASA cloud logging uses the on-premises SDC VM to compress syslog and NSEL events before sending them to the Cisco cloud. This page confirms the SDC VM is the correct component (D) and explains why alternatives like SWC service and CDO event viewer are wrong.

Selecting SWC service because its name suggests it handles log compression, but the official ASA-to-cloud flow places compression in the Security Event Connector on the SDC VM.

Community Discussion (6 comments)

ITPro21 👍 1 Selected: D
CDC Compresses SWC Parses
aa4a63c 👍 1 Selected: D
ASA sends events (syslog and NSEL events) to the SEC component of the SDC VM that is configured in CDO. The SEC accepts both TCP and UDP syslogs from ASA and compresses the events. From here on, the events are securely transferred to the Cisco cloud. The SEC sends the compressed events to the cloud-based Eventing Service
dorf05 👍 1 Selected: C
SWC is use for compressing logs before it sent to the cloud.
Surfside92 👍 1 Selected: D
The on-premises SDC is a virtual appliance installed on a hypervisor in your network.
dfb0b7d 👍 1 Selected: D
https://www.cisco.com/c/en/us/td/docs/security/asa/special/sal-saas/cisco-asa-and-cisco-security-analytics-and-logging-asdm-integration-guide.html
klu16 👍 3 Selected: D
https://www.cisco.com/c/en/us/td/docs/security/asa/special/sal-saas/cisco-asa-and-cisco-security-analytics-and-logging-asdm-integration-guide.html Refer to the chapter: ASA Event Flow in SAL

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

The Secure Device Connector (SDC) VM hosts the Security Event Connector (SEC), which receives syslog and NSEL events from the Cisco ASA, compresses them, and securely forwards them to the Cisco cloud Eventing Service. The official Cisco ASA and SAL integration guide's "ASA Event Flow in SAL" chapter confirms that compression occurs at the SEC on the SDC VM. Therefore, configuring the SDC VM is required to accomplish the goal of compressing events for cloud logging. Since the question asks which component must be configured, the SDC VM is the correct choice (D).

Why the Other Options Are Wrong

Cisco analytics (A) is the cloud-based analytics service where events are ultimately analyzed, not the on-premises component that compresses them. The CDO event viewer (B) is a user interface within Cisco Defense Orchestrator for viewing events; it does not perform compression. The SWC service (C) is sometimes mistakenly associated with log compression, but official SAL documentation places compression in the SEC component of the SDC VM, not in SWC. None of these alternatives match the documented ASA-to-cloud event flow.

Community Comment Notes

As aa4a63c explained, ASA sends events to "the SEC component of the SDC VM" which then compresses them before secure transfer to the Cisco cloud. klu16 pointed to the official Cisco integration guide and specifically the "ASA Event Flow in SAL" chapter for confirmation. dorf05 claimed SWC is used for compressing logs, but that contradicts the documented flow and the overwhelming vote consensus. The community's strong majority for D aligns with the vendor documentation.

Official Reference

Exam Strategy

Memorize the SAL event flow: ASA sends syslog and NSEL to the SEC on the SDC VM, which compresses and forwards to the cloud. In exam questions, compression is performed by the on-premises SDC VM, not by cloud services or UI viewers.

Frequently Asked Questions

Why does the SDC VM compress ASA events instead of the CDO event viewer?

The SDC VM hosts the Security Event Connector (SEC), which receives ASA syslog and NSEL events, compresses them, and forwards them to the Cisco cloud; the CDO event viewer only displays events.

Is the SWC service ever responsible for compressing logs in Cisco SAL?

No. Official SAL documentation shows the on-premises SDC VM's Security Event Connector performs compression; SWC is not the configured compression component for ASA cloud logging.

Related Analysis

← Back to 350-701 Study Guide