Examkin

Soru

Zorluk: OrtaCommon Ports and Protocols

A security operations engineer is setting up a centralized SIEM server to aggregate system logs and security events from enterprise core switches. To ensure standard unencrypted syslog traffic successfully reaches the collector, which port and transport protocol combination must be permitted on the network firewalls?

  1. UDP port 514Cevap
  2. B
    TCP port 514
  3. C
    UDP port 162
  4. D
    UDP port 161

Cevap

Standard Syslog messages require UDP port 514 to be allowed through network firewalls.
Standard Syslog utilizes User Datagram Protocol (UDP) on port 514 to transmit event notification messages to a central log server without session establishment overhead.

Adım Adım Çözüm

1
Identify the protocol required for system logging
The scenario describes gathering system logs and security events via standard syslog messages.
Syslog is the standard protocol for message logging across network devices.
2
Determine the default port number and transport layer protocol for standard Syslog
Standard Syslog defaults to UDP port 514.
UDP 514 allows low-overhead, connectionless transmission of log data to the collector.

Anahtar Kavram

Syslog Protocol and Port Number
Tahmini Süre:1m 0s
Bu soruyu puanla

Konular

Common Ports and Protocols

Bu konudan daha fazla soru