312-50V9 · Question #84
Which protocol and port number might be needed in order to send log messages to a log analysis tool that resides behind a firewall?
The correct answer is C. UDP 514. Syslog uses UDP port 514 by default to transport log messages to a centralized log analysis server or SIEM.
Question
Which protocol and port number might be needed in order to send log messages to a log analysis tool that resides behind a firewall?
Options
- AUDP 123
- BUDP 541
- CUDP 514
- DUDP 415
How the community answered
(24 responses)- A4% (1)
- C88% (21)
- D8% (2)
Why each option
Syslog uses UDP port 514 by default to transport log messages to a centralized log analysis server or SIEM.
UDP 123 is the port used by the Network Time Protocol (NTP) for time synchronization, not log forwarding.
UDP 541 is not assigned to any standard logging or syslog-related protocol.
UDP 514 is the well-known port assigned to the Syslog protocol as defined in RFC 3164 and updated in RFC 5424. When sending log messages from network devices or hosts to a remote log analysis tool behind a firewall, UDP 514 must be permitted through the firewall policy.
UDP 415 is not a recognized or standardized port for syslog or any common log forwarding protocol.
Concept tested: Syslog protocol default port UDP 514
Source: https://datatracker.ietf.org/doc/html/rfc5424
Topics
Community Discussion
No community discussion yet for this question.