N10-009 Question 77
Single answerSyslog: 514A network administrator deploys a centralized log server to collect messages from routers, switches, and firewalls. The devices are configured to send syslog events to 10.20.30.50, but no logs are arriving at the server. Basic IP connectivity to the server is working, and the server's syslog service is running. Which firewall rule should the administrator verify first to allow standard syslog traffic from the network devices to the log server?
- A
Allow UDP port 514 from the network devices to 10.20.30.50
- B
Allow TCP port 514 from 10.20.30.50 to the network devices
- C
Allow UDP port 161 from the network devices to 10.20.30.50
- D
Allow TCP port 443 from the network devices to 10.20.30.50
Show answer and explanation
Correct answer: A
Explanation
This question tests practical troubleshooting of centralized logging. In a typical Network+ scenario, when a syslog server is reachable and the service is running but logs are not arriving, the next step is to verify that intervening firewalls permit syslog traffic. Traditional syslog uses UDP port 514, sent from the client device to the syslog collector. This aligns with common operational practice and with standard syslog behavior described in RFC 5424 and related syslog transport guidance. Although some environments use TCP-based syslog or encrypted logging methods, the standard port/protocol most commonly associated with syslog on Network+ is UDP 514. Therefore, the best first firewall rule to verify is inbound UDP 514 to the log server from the network devices.
- A. Correct.
Correct. Standard syslog commonly uses UDP port 514 for log message delivery from network devices to a syslog collector. If devices are configured correctly and connectivity exists, the first firewall rule to check is whether UDP/514 is permitted from the sending devices to the syslog server.
- B. Incorrect.
Incorrect. This reverses the traffic direction and uses the less typical transport for traditional syslog collection. Standard syslog messages from infrastructure devices are generally sent from the devices to the collector, most commonly over UDP 514. While some implementations can use TCP, the question asks about standard syslog traffic and the immediate firewall rule to verify first.
- C. Incorrect.
Incorrect. UDP 161 is used by SNMP queries, not syslog. This is a common confusion because both SNMP and syslog are used for monitoring and management, but they serve different purposes and use different ports.
- D. Incorrect.
Incorrect. TCP 443 is HTTPS, which is unrelated to standard syslog transport. A candidate might choose this if thinking generally about secure management traffic, but HTTPS is not the default protocol/port for syslog message forwarding.