Exam 350-901 topic 1 question 157 discussion

B and E Keyword here is distributed. C has nothing to do with it.

Sorry, I muss correct me. I mean best is B&C.

B&C makes sense

Why not CD ? elk for example. ton of logging plugins (C). logs could be modified/filtered/processed before exporting (D)

the question states 'benefits' not features

C: provides flexibility due to a wide range of plugins and accepted log formats... the distributed server can then translate/reformat the logs it received before sending to the centralized logging repository, so the centralized repository has all logs in a common format E: the distributed server can receive the incoming logs within a remote data center or edge data center or geography, then continually retry transmitting to the centralized logging repository until network connectivity to the centralized logging repository is restored

BC..........

giving that the key word is "distributed", I would go with A & B. A. supports multiple transport protocols such as TCP/UDP - This could be done using TCP or UDP - correct - its a plus B. improves performance and reduces resource consumption - It will improve the CPU of the application, but centralized logging will consume more CPU per application - correct just because they specified "distributed" I like C but nothing to do with Distributed.

B&C seems best to me.

About performance: "The utility of logs, unfortunately, ends right there. While log generation might be easy, the performance idiosyncrasies of various popular logging libraries leave a lot to be desired. Most performant logging libraries allocate very little, if any, and are extremely fast. However, the default logging libraries of many languages and frameworks are not the cream of the crop, which means the application as a whole becomes susceptible to suboptimal performance due to the overhead of logging. "

A and C seem more correct than the others. A. supports multiple transport protocols such as TCP/UDP - This could be done using TCP or UDP - correct B. improves performance and reduces resource consumption - It will improve the CPU of the application, but centralized logging will consume more CPU per application since we can specify that the log will be processed by the logging instead of being processed locally. In network devices, we can spread which logs will be processed locally and which ones will not. I'm not sure if this could be easily applied to the code. C. provides flexibility due to a wide range of plugins and accepted log formats - It is correct since we can use the ELK (Elasticsearch, Logstash, Kibana) stack. D. enables extension of logs with fields and export to backend systems - Incorrect E. buffers and resends data when the network is unavailable - We can establish a limit for network devices to buffer their logs and discard them if this limit is reached, but I'm not sure if this could be applied here.

All seem a bit off, even B. distributing the log collection still uses resources, and probably even more. 1 server with the power of 10 distributed servers has less overhead.

The only option that in indisputably correct is B. Everything else depends so much on what is the actual environment and the configs in use on devices and log collectors.

I think it's A&C!

Not sure but B&E seems the correct answer