Cisco ASA SAL Integration Prerequisites
Short answer
C Onboard Cisco ASA device to CDO is needed.
Question
Key Takeaways
This question tests the prerequisite steps for enabling SAL, specifically the dependency on CDO onboarding rather than just network connectivity or version compatibility.
Configuring Security Analytics and Logging (SAL) on Cisco ASA requires the device to be onboarded to Cisco Defense Orchestrator (CDO). This process establishes the necessary management plane for cloud logging integration.
Common mistake: Many candidates choose Option A, assuming regional restrictions are the primary configuration hurdle, but the fundamental requirement is establishing the device identity in CDO first.
Expert Analysis
Why the Answer Is Correct
The correct answer is C because Cisco Security Analytics and Logging (SAL) relies on a centralized management hierarchy. Before any syslog events can be sent to the cloud, the ASA must be onboarded to Cisco Defense Orchestrator (CDO). The official documentation states that you must "Onboard ASA Device to CDO" as a preliminary step to configure the connection parameters.
Why the Other Options Are Wrong
Option A is incorrect because while regional constraints exist, they are not the primary configuration parameter for establishing the link; the device must simply be assigned to a region during onboarding. Option B is false because specific ASA IOS-XE versions and FTD versions are required, not all CSM versions. Option D is misleading as storage is managed by the service provider, not dynamically allocated by the engineer at the device level.
Community Comment Notes
Community feedback strongly supports C, with users citing the 'Before you Begin' section of the implementation guide which explicitly lists onboarding to CDO as the first mandatory step. One user noted, "Be sure to review 'Before you Begin' above to make sure your environment is properly configured," reinforcing that technical configuration follows administrative onboarding.
Official Reference
This link opens the official vendor documentation in a new tab.
Exam Strategy
Always check for management plane prerequisites before diving into data plane configurations. For cloud-integrated security services like SAL, identify if onboarding to a central orchestrator (like CDO) is required.
Frequently Asked Questions
Why is onboarding to CDO required for SAL?
Can I send logs without CDO onboarding?
Community Votes
100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
luismg 👍 2 Answered CThe answer is C https://docs.defenseorchestrator.com/c_implementing-cisco-security-analytics-and-logging-saas-for-asa-devices.html Be sure to review "Before you Begin" above to make sure your environment is properly configured. Onboard ASA Device to CDO using username and password. Send ASA Syslog Events to the Cisco Cloud. Configuring NSEL for ASA Devices Using a CDO Macro. Confirm events are visible in CDO. From the navigation bar, select Monitoring > Event Logging. Click the Live tab to view live events. If you have a Firewall Analytics and Monitoring or Total Network Analytics and Monitoring license, continue with the next section, Analyzing Events with Cisco Secure Cloud Analytics.
-
dya11 👍 2Seems to be A: Determine which regional cloud you will send events to. "Events cannot be viewed from or moved between different regional clouds." https://www.cisco.com/c/en/us/td/docs/security/asa/special/sal-saas/cisco-asa-and-cisco-security-analytics-and-logging-asdm-integration-guide.html
-
Arian5431 👍 1C correct Answer
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.