Business Continuity, DR & Incident Response →hardMultiple ChoiceObjective-mapped

ISC2 CC Business Continuity, DR & Incident Response Practice Question

Exhibit

Refer to the exhibit.

syslog-ng configuration:
@version: 3.35
destination d_remote { syslog("10.0.0.10" transport("tls") port(6514)); };
log { source(s_sys); destination(d_remote); };

Firewall rule on logging server:
permit tcp host 10.0.0.10 eq 6514 host 192.168.1.100

The exhibit shows a syslog-ng client configuration and a firewall rule on the central logging server (IP 10.0.0.10). The client (192.168.1.100) is not sending logs to the server. What is the most likely cause?

⚠ Common exam trap

Many exam-takers assume the firewall rule's source port 6514 is irrelevant or that the client must use the same port as the server, when in fact the client uses an ephemeral source port, making the rule overly restrictive and the cause of the failure.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The firewall rule restricts source port 6514, but the client uses a random ephemeral source port

The firewall rule on the central logging server (10.0.0.10) specifies a source port of 6514. However, syslog-ng clients, when sending over TCP or TLS, typically use a random ephemeral source port (e.g., above 1024) rather than a fixed source port. Since the firewall restricts the source port to exactly 6514, the client's packets are dropped, preventing logs from reaching the server.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The syslog-ng configuration uses TLS, but the firewall rule does not allow TLS traffic
Why it's wrong here
TLS over TCP is still TCP; the firewall rule permits TCP, so TLS is allowed.
✓
The firewall rule restricts source port 6514, but the client uses a random ephemeral source port
Why this is correct
The rule includes 'eq 6514' which matches only if source port is 6514; clients use dynamic ports.
✗
The syslog-ng client uses UDP by default, but the firewall allows only TCP
Why it's wrong here
The client configuration explicitly uses TCP transport (tls).
✗
The firewall rule does not include the client IP 192.168.1.100
Why it's wrong here
The rule includes the host 192.168.1.100 as the destination, which is correct for server receiving logs.

Go deeper

ISC2 CC Business Continuity, DR & Incident Response Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question