N10-009 Network Operations Practice Question
A network administrator configures a router to send syslog messages to a central log server. The administrator can ping the server from the router, but the server is not receiving any logs. What is the most likely cause?
⚠ Common exam trap
The trap here is that candidates see 'ping works' and assume full connectivity, forgetting that syslog uses a specific UDP port that may be filtered even when ICMP is permitted.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
UDP port 514 is blocked between the router and the server
Syslog messages are sent via UDP port 514 by default. Since the administrator can ping the server (ICMP works), but no logs arrive, the most likely cause is that a firewall or ACL is blocking UDP port 514 between the router and the server. This is a classic connectivity issue where Layer 3 reachability exists but the specific transport-layer port is filtered.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The syslog server is using the wrong protocol (TCP instead of UDP)
Why it's wrong here
While modern syslog implementations like Syslog-ng or rsyslog can be configured to use TCP for reliable log delivery, the traditional and default protocol for syslog is UDP. If the router is configured to send syslog via UDP, and the server is exclusively listening for TCP connections on port 514, the UDP packets from the router would simply be ignored by the server's syslog daemon. However, a server misconfiguration of listening protocol is less common than an intermediate firewall blocking the standard UDP port, especially when the router is sending via the default UDP.
When this WOULD be correct
If the question specified that the syslog server is configured to receive logs over TCP (e.g., for reliable delivery) and the router is sending UDP, then the protocol mismatch would be the cause.
- ✓
UDP port 514 is blocked between the router and the server
Why this is correct
Syslog, by default, transmits log messages using the User Datagram Protocol (UDP) on port 514. Although the router can successfully ping the server, indicating basic network layer connectivity, a firewall or Access Control List (ACL) along the path could be specifically configured to block UDP traffic on port 514. Since UDP is connectionless, the router will send the packets, but they will be dropped before reaching the server's syslog daemon, preventing log delivery. This is a common network security configuration issue.
- ✗
The syslog service on the server is not running
Why it's wrong here
If the service were not running, the server would not respond, but that would not prevent the router from sending the messages; the server simply would not log them. The lack of receipt indicates a delivery problem.
When this WOULD be correct
This option would be correct in a scenario where the administrator can ping the server and the firewall allows UDP 514, but logs are still not appearing. For example, if the syslog daemon on the server has crashed or is misconfigured to listen on a different port, the server would not receive logs despite network connectivity.
- ✗
The router's clock is not synchronized with the server
Why it's wrong here
A lack of clock synchronization between the router and the syslog server primarily affects the accuracy and consistency of timestamps within the log messages themselves. While crucial for forensic analysis, correlation of events, and proper auditing, incorrect time settings do not impede the actual transmission or reception of syslog packets. The router would still generate and send syslog messages, and the server would still receive and log them, albeit with potentially inaccurate timestamps. This issue impacts data utility, not network transport.
When this WOULD be correct
In a scenario where the syslog server is receiving logs but they contain incorrect timestamps, the most likely cause would be that the router's clock is not synchronized with the server. For example, if logs show events from the future or past, NTP misconfiguration would be the primary suspect.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓UDP port 514 is blocked between the router and the serverCorrect answer▾
Why this is correct
Syslog, by default, transmits log messages using the User Datagram Protocol (UDP) on port 514. Although the router can successfully ping the server, indicating basic network layer connectivity, a firewall or Access Control List (ACL) along the path could be specifically configured to block UDP traffic on port 514. Since UDP is connectionless, the router will send the packets, but they will be dropped before reaching the server's syslog daemon, preventing log delivery. This is a common network security configuration issue.
✗The syslog server is using the wrong protocol (TCP instead of UDP)Wrong answer — click to see why▾
Why this is wrong here
Syslog messages are sent via UDP by default, not TCP. The question states the server is not receiving logs despite successful ping, indicating a network filtering issue rather than a protocol mismatch.
★ When this WOULD be the correct answer
If the question specified that the syslog server is configured to receive logs over TCP (e.g., for reliable delivery) and the router is sending UDP, then the protocol mismatch would be the cause.
Why candidates choose this
Candidates may confuse syslog's default UDP transport with other services that use TCP, or assume that a protocol mismatch is a common cause of connectivity issues.
✗The syslog service on the server is not runningWrong answer — click to see why▾
Why this is wrong here
The administrator can ping the server, indicating network connectivity, but the server is not receiving logs. If the syslog service were not running, the server would still receive the UDP packets but would not process them; however, the question states the server is not receiving any logs, implying the packets are not reaching the server, which points to a firewall blocking UDP port 514 rather than a service issue.
★ When this WOULD be the correct answer
This option would be correct in a scenario where the administrator can ping the server and the firewall allows UDP 514, but logs are still not appearing. For example, if the syslog daemon on the server has crashed or is misconfigured to listen on a different port, the server would not receive logs despite network connectivity.
Why candidates choose this
Candidates may think that if the service is not running, logs cannot be received, overlooking that the question states the server is not receiving any logs (packets not arriving) rather than logs arriving but not being processed. They also might assume a service issue is more common than a firewall block.
✗The router's clock is not synchronized with the serverWrong answer — click to see why▾
Why this is wrong here
The router can ping the server, indicating basic IP connectivity. Syslog uses UDP port 514 by default; if the server were not running the syslog service, the router would still send messages, but they would be dropped at the server. The issue is more likely a firewall blocking UDP 514, as the server not running would not prevent the router from sending (it would just not process them).
★ When this WOULD be the correct answer
In a scenario where the syslog server is receiving logs but they contain incorrect timestamps, the most likely cause would be that the router's clock is not synchronized with the server. For example, if logs show events from the future or past, NTP misconfiguration would be the primary suspect.
Why candidates choose this
Candidates may think that clock synchronization is critical for syslog to function at all, confusing timestamp accuracy with the ability to receive logs. They might also assume that a ping response implies full network path availability, overlooking that ping uses ICMP while syslog uses UDP, which can be blocked separately.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Network Documentation and Diagrams
Key term
Syslog
Syslog is a standard protocol used to send and store log messages from network devices and servers to a central logging server for monitoring and troubleshooting.
Key term
UDP
UDP (User Datagram Protocol) is a communication protocol that sends data quickly without first checking if the receiver is ready or if the data arrived correctly.
About these practice questions
Courseiva writes every N10-009 question from scratch — 464 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.