nerdexam
CompTIA

CV0-003 · Question #42

An administrator is no longer receiving alerting messages from the web server platform that recently failed over to a new secondary datacenter due to a power failure. Which of the following is the cau

The correct answer is B. Port 22 to the log server is blocked outbound. After failover to a secondary datacenter, outbound firewall rules may not mirror those of the primary, blocking the server from sending log or alert traffic to the log server on port 22.

Troubleshooting

Question

An administrator is no longer receiving alerting messages from the web server platform that recently failed over to a new secondary datacenter due to a power failure. Which of the following is the cause of the problem?

Options

  • APort 21 in only allowed inbound at the primary datacenter
  • BPort 22 to the log server is blocked outbound
  • CPort 162 in DMZ is blocked inbound
  • DPort 162 in DMZ is blocked outbound

How the community answered

(54 responses)
  • A
    6% (3)
  • B
    63% (34)
  • C
    20% (11)
  • D
    11% (6)

Why each option

After failover to a secondary datacenter, outbound firewall rules may not mirror those of the primary, blocking the server from sending log or alert traffic to the log server on port 22.

APort 21 in only allowed inbound at the primary datacenter

Port 21 (FTP) inbound at the primary datacenter is irrelevant because the server has already failed over to the secondary and inbound FTP does not affect outbound alert delivery.

BPort 22 to the log server is blocked outboundCorrect

Port 22 (SSH) is commonly used for secure log forwarding agents such as rsyslog over SSH or proprietary monitoring agents that ship alert data to a centralized log server. If the secondary datacenter firewall does not have an outbound rule permitting port 22 to the log server - a rule that existed at the primary - the web server silently fails to deliver alerts after failover. This is a classic DR misconfiguration where network policy is not replicated alongside the workload.

CPort 162 in DMZ is blocked inbound

Port 162 (SNMP trap) blocked inbound in the DMZ would prevent a management station inside the DMZ from receiving traps, but does not explain why outbound alerting from the web server fails.

DPort 162 in DMZ is blocked outbound

Port 162 outbound blocked in the DMZ would affect SNMP trap delivery, but the scenario specifies a log server as the alerting destination, pointing to an SSH-based forwarding path rather than SNMP.

Concept tested: Firewall port rules blocking outbound log forwarding after failover

Source: https://www.rfc-editor.org/rfc/rfc4251

Topics

#port blocking#log forwarding#SNMP traps#alerting

Community Discussion

No community discussion yet for this question.

Full CV0-003 Practice