312-50V10 · Question #311
Which protocol and port number might be needed in order to send log messages to a log analysis tool that resides behind a firewall?
The correct answer is C. UDP 514. Syslog uses UDP port 514 to transmit log messages to remote log analysis tools, making firewall rules for this port necessary.
Question
Which protocol and port number might be needed in order to send log messages to a log analysis tool that resides behind a firewall?
Options
- AUDP 123
- BUDP 541
- CUDP 514
- DUDP 415
How the community answered
(48 responses)- A2% (1)
- B4% (2)
- C92% (44)
- D2% (1)
Why each option
Syslog uses UDP port 514 to transmit log messages to remote log analysis tools, making firewall rules for this port necessary.
UDP 123 is reserved for the Network Time Protocol (NTP) and has no role in log message transmission.
UDP 541 is not an IANA-assigned port for any standard logging protocol.
UDP 514 is the well-known port assigned to the Syslog protocol (RFC 3164/5424), which is the standard used by network devices, servers, and security appliances to forward log messages to a centralized log collector or SIEM. Any firewall sitting between the log source and the log analysis tool must permit UDP 514 outbound for log forwarding to function.
UDP 415 is not associated with any standard log forwarding protocol.
Concept tested: Syslog protocol port for log forwarding
Source: https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml
Topics
Community Discussion
No community discussion yet for this question.