nerdexam
EC-Council

312-50V9 · Question #84

Which protocol and port number might be needed in order to send log messages to a log analysis tool that resides behind a firewall?

The correct answer is C. UDP 514. Syslog uses UDP port 514 by default to transport log messages to a centralized log analysis server or SIEM.

Evading IDS, Firewalls, and Honeypots

Question

Which protocol and port number might be needed in order to send log messages to a log analysis tool that resides behind a firewall?

Options

  • AUDP 123
  • BUDP 541
  • CUDP 514
  • DUDP 415

How the community answered

(24 responses)
  • A
    4% (1)
  • C
    88% (21)
  • D
    8% (2)

Why each option

Syslog uses UDP port 514 by default to transport log messages to a centralized log analysis server or SIEM.

AUDP 123

UDP 123 is the port used by the Network Time Protocol (NTP) for time synchronization, not log forwarding.

BUDP 541

UDP 541 is not assigned to any standard logging or syslog-related protocol.

CUDP 514Correct

UDP 514 is the well-known port assigned to the Syslog protocol as defined in RFC 3164 and updated in RFC 5424. When sending log messages from network devices or hosts to a remote log analysis tool behind a firewall, UDP 514 must be permitted through the firewall policy.

DUDP 415

UDP 415 is not a recognized or standardized port for syslog or any common log forwarding protocol.

Concept tested: Syslog protocol default port UDP 514

Source: https://datatracker.ietf.org/doc/html/rfc5424

Topics

#syslog#UDP 514#log management#firewall ports

Community Discussion

No community discussion yet for this question.

Full 312-50V9 Practice