Exam CV0-003 topic 1 question 236 discussion

For sending syslog data from the web servers to the central log collector, you should typically use UDP port 514. Syslog commonly uses UDP as the transport protocol. So, you should allow outbound traffic from the web servers on UDP port 514 to the central log collector. The correct answer is: B. Allow TCP 514 outbound from the web servers to the log collector. Please note that while UDP is more common for syslog, there are situations where TCP may be used, especially for reliable and secure log transmission. However, UDP 514 is the traditional syslog port for non-secure syslog messages. If you are using TCP, you would need to specify it in your syslog configuration.

The correct answer is B. Syslog uses port 514 for communication, and the web servers are sending logs to the central log collector. Therefore, the firewall rule should allow outbound traffic from the web servers to the log collector on TCP port 514. A is incorrect because UDP port 161 is used by SNMP, not syslog.

The default protocol for sending syslogs is UDP with a default port of 514. For TCP, the default port is 1468 The TCP port is only recently started being used.

514 is UDP... BUT this is what I found, hope this helps someone. https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html