Examkin

Question

Difficulty: MediumCommon Ports and Protocols

A security operations engineer is setting up a centralized SIEM server to aggregate system logs and security events from enterprise core switches. To ensure standard unencrypted syslog traffic successfully reaches the collector, which port and transport protocol combination must be permitted on the network firewalls?

  1. UDP port 514Answer
  2. B
    TCP port 514
  3. C
    UDP port 162
  4. D
    UDP port 161

Answer

Standard Syslog messages require UDP port 514 to be allowed through network firewalls.
Standard Syslog utilizes User Datagram Protocol (UDP) on port 514 to transmit event notification messages to a central log server without session establishment overhead.

Step-by-Step Solution

1
Identify the protocol required for system logging
The scenario describes gathering system logs and security events via standard syslog messages.
Syslog is the standard protocol for message logging across network devices.
2
Determine the default port number and transport layer protocol for standard Syslog
Standard Syslog defaults to UDP port 514.
UDP 514 allows low-overhead, connectionless transmission of log data to the collector.

Key Concept

Syslog Protocol and Port Number
Estimated Time:1m 0s
Rate this question

Topics

Common Ports and Protocols

More questions from this topic