Regarding security, out of the box, a "zabbix-selinux-policy" package whitelists the bare minimum ports.

When implementing custom "net.tcp.service" checks and if SELinux works in enforced mode, then it will still result in a non-working data collection.

On the page:

https://www.zabbix.com/documentation/6.0/en/manual/config/items/itemtypes/simple_checks

https://www.zabbix.com/documentation/current/en/manual/config/items/itemtypes/simple_checks

There should be a hint:

If SELinux works in enforced mode. Please check if the new outgoing connection has not been blocked:

grep denied /var/log/audit/audit.log