312-50V11 · Question #311
Which protocol and port number might be needed in order to send log messages to a log analysis tool that resides behind a firewall?
The correct answer is C. UDP 514. Syslog, the standard protocol for transmitting log messages, operates on UDP port 514, which must be allowed through a firewall for logs to reach a remote analysis tool.
Question
Which protocol and port number might be needed in order to send log messages to a log analysis tool that resides behind a firewall?
Options
- AUDP 123
- BUDP 541
- CUDP 514
- DUDP 415
How the community answered
(37 responses)- B3% (1)
- C95% (35)
- D3% (1)
Why each option
Syslog, the standard protocol for transmitting log messages, operates on UDP port 514, which must be allowed through a firewall for logs to reach a remote analysis tool.
UDP port 123 is assigned to NTP (Network Time Protocol) for clock synchronization, not for log transmission.
UDP port 541 is not a standard or IANA-registered port for syslog or any common log forwarding protocol.
UDP port 514 is the well-known, IANA-registered port for the syslog protocol as defined in RFC 3164 and updated in RFC 5424. Network devices, servers, and security appliances send log messages to a central log analysis tool (SIEM) using this protocol and port, so firewall rules must permit UDP 514 inbound to the log collector.
UDP port 415 is not associated with syslog or any standard log analysis protocol.
Concept tested: Syslog protocol port UDP 514 for log forwarding
Source: https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml
Topics
Community Discussion
No community discussion yet for this question.