Examkin

Question

Difficulty: HardCommon Ports and Protocols

A network security administrator is configuring stateful firewall rules to integrate a newly deployed Security Information and Event Management (SIEM) appliance within an enterprise network. Per company compliance requirements, all remote system logging sent from internal infrastructure switches to the SIEM must be encrypted over the wire using Transport Layer Security (TLS) to guarantee confidentiality and data integrity. Which protocol and transport layer port combination must the administrator permit on the firewall to allow this secure log transmission?

  1. TCP port 6514Answer
  2. B
    UDP port 514
  3. C
    UDP port 6514
  4. D
    TCP port 514

Answer

TCP port 6514
The standard port designated by IANA for secure, TLS-encrypted Syslog traffic (as defined in RFC 5425) is TCP port 6514. TLS requires TCP to handle session negotiation, cryptographic certificates, and reliable packet delivery.

Step-by-Step Solution

1
Identify the base service and security requirements specified in the scenario
The requirement calls for remote system logging (Syslog) secured with Transport Layer Security (TLS) encryption.
Standard Syslog operates unencrypted, but enterprise compliance mandates TLS encapsulation.
2
Determine the transport protocol required for TLS operation
TLS requires TCP due to its connection-oriented nature and reliable stream handling during key exchange.
UDP is connectionless and cannot host standard TLS sessions without specialized protocols like DTLS.
3
Select the standard well-known/registered port number assigned for Syslog over TLS
IANA specifies TCP port 65146514 for Syslog over TLS (RFC 5425), whereas unencrypted Syslog defaults to UDP port 514514.
Matching the correct port and protocol ensures compliance and proper firewall rule baseline.

Key Concept

Syslog over TLS (TCP Port 6514) vs Standard Syslog (UDP Port 514)
Rate this question

Topics

Common Ports and Protocols

More questions from this topic