A network engineer is creating firewall rules to allow Instana host agents in an isolated production network segment to communicate with an on-premises Instana backend server. Which TCP port must be permitted for outbound traffic from agent hosts to the backend?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Instana agents communicate with the backend exclusively over TCP port 443 using TLS encryption, which is the standard HTTPS port. This design simplifies firewall configuration because most corporate firewalls and forward proxy servers already permit outbound HTTPS traffic on port 443 without requiring special rules. Port 9042 is used internally by Cassandra for database client connections and is not an agent-to-backend communication port.
Full explanation below image
Full Explanation
Instana agents communicate with the backend exclusively over TCP port 443 using TLS encryption, which is the standard HTTPS port. This design simplifies firewall configuration because most corporate firewalls and forward proxy servers already permit outbound HTTPS traffic on port 443 without requiring special rules. Port 9042 is used internally by Cassandra for database client connections and is not an agent-to-backend communication port. The correct answer is 'TCP port 443 used for encrypted TLS agent-to-backend communication'. The incorrect options — 'TCP port 8080 used for Instana unencrypted HTTP agent communication', 'TCP port 8443 used as the Instana alternate encrypted agent endpoint', 'TCP port 9042 used for Instana Cassandra agent data submission' — are wrong because they do not align with IBM Instana's architecture or recommended practices for this scenario. Understanding this concept is essential for the Domain 3: Installation domain of the IBM Instana Observability certification.