Security+ SY0-701 Ports and Protocols

A one-page reference from CertStack. Print it, or practice it in the app.

How to use this on the exam. Match the protocol, its role, and the security property the scenario asks for. A name with an S in it, or a higher version number, does not by itself mean encrypted: SNMPv3 and SMB 3 are only as secure as they are configured, and SMTP starts with S. Read the scenario for the words encrypt, cleartext, legacy, monitor, time, and name resolution, then find the row.

Ports the objectives point at

SY0-701 asks you to select secure protocols, ports and transports (objective 4.5) and to configure firewall ports and protocols, but publishes no mandatory port list. These are the ones that recur in that work. Port numbers were checked against the IANA registry on 2026-09-25.

Port	Protocol	Transport	Used for	Security note
20, 21	FTP	TCP	File transfer, cleartext (21 control, 20 data in active mode)	Use SFTP over SSH (22). FTPS is FTP with TLS: explicit FTPS commonly on 21, implicit on 990.
22	SSH, SFTP, SCP	TCP	Encrypted remote shell and file copy	Encrypted by design. Replaces Telnet, FTP and rsh.
23	Telnet	TCP	Remote shell, cleartext	Replace with SSH (22).
25	SMTP	TCP	Server-to-server mail relay	Cleartext unless STARTTLS is enforced. Not replaced by 587 or 465, which are client submission ports.
49	TACACS+	TCP	Device administration AAA (Cisco origin)	Encrypts the packet body; compare with RADIUS, which encrypts only the password.
53	DNS	UDP and TCP	Name resolution; TCP for zone transfers and large replies	DNSSEC adds origin authentication and integrity, not confidentiality, still on 53. DNS over TLS uses 853; DNS over HTTPS uses 443.
67, 68	DHCP	UDP	Address assignment (67 server, 68 client)	No authentication; rogue DHCP is mitigated at the switch (DHCP snooping).
69	TFTP	UDP	Trivial file transfer, no authentication	Cleartext. Use SFTP (22) where a choice exists.
80	HTTP	TCP	Web, cleartext	Use HTTPS (443).
88	Kerberos	UDP and TCP	Ticket-based authentication (Active Directory)	Encrypted tickets; depends on accurate time (see NTP).
110	POP3	TCP	Mail retrieval, usually downloaded to a client	Cleartext. Use POP3S (995).
123	NTP	UDP	Time synchronisation; log correlation and Kerberos depend on it	Authenticated NTP or NTS where available.
137, 138, 139	NetBIOS	137 UDP/TCP, 138 UDP, 139 TCP	Legacy Windows name service (137), datagrams (138), sessions (139)	Legacy. Modern SMB runs directly on 445; block NetBIOS at the perimeter.
143	IMAP	TCP	Mail retrieval with server-side folders	Cleartext. Use IMAPS (993).
161, 162	SNMP	UDP	Device monitoring (161 agent queries, 162 traps)	v1 and v2c send community strings in cleartext. Use SNMPv3 with authentication and privacy enabled.
389	LDAP	TCP and UDP	Directory queries	Cleartext unless STARTTLS. Use LDAPS (636).
443	HTTPS	TCP	Web over TLS	Encrypted by design. Also carries DNS over HTTPS and many VPNs.
445	SMB	TCP	Windows file and printer sharing	Use SMB 3.x with signing enforced and, where confidentiality is required, encryption enforced. Never expose to the internet.
465	SMTPS	TCP	Client mail submission over implicit TLS	Encrypted by design.
500, 4500	IKE, IPsec NAT-T	UDP	IPsec VPN key exchange; 4500 when NAT is in the path	Encrypted by design (with ESP for the tunnel).
514	Syslog	UDP	Log forwarding, cleartext	Use syslog over TLS (6514, TCP).
587	SMTP submission	TCP	Client-to-server mail submission	Secure when STARTTLS is required; otherwise cleartext.
636	LDAPS	TCP	Directory over TLS	Encrypted by design.
853	DNS over TLS	TCP	Encrypted name resolution	Confidentiality for DNS queries; pair with DNSSEC for integrity.
993	IMAPS	TCP	IMAP over TLS	Encrypted by design.
995	POP3S	TCP	POP3 over TLS	Encrypted by design.
1812, 1813	RADIUS	UDP	Network access authentication (1812) and accounting (1813)	Encrypts only the password field. RADIUS over TLS (RadSec, 2083) for the whole exchange.
3389	RDP	TCP and UDP	Windows remote desktop	Enable Network Level Authentication and TLS; reach it through a VPN or gateway, never directly from the internet.

Useful operational context

Not named in the SY0-701 objectives, but common in scenarios and firewall questions.

Port	Protocol	Transport	Used for	Security note
1433	Microsoft SQL Server	TCP	Default instance listener	Restrict exposure, enforce TLS on the listener.
3306	MySQL	TCP	Database listener	Same: isolate and enforce TLS.
5060	SIP	UDP and TCP	VoIP call signalling	Cleartext signalling.
5061	SIP over TLS	TCP	Encrypted VoIP signalling	Protects signalling only; SRTP protects the media stream.
1194	OpenVPN	UDP and TCP	SSL/TLS VPN	Encrypted by design.

Memory aids

The twenties are the old shells and copies: 20 and 21 FTP, 22 SSH, 23 Telnet, 25 SMTP.
Mail in: 110 POP3 and 143 IMAP. Mail out: 25 relay, 587 and 465 submission. The TLS versions of mail-in are 995 and 993.
Directory: 389 LDAP, 636 LDAPS. Add 247 to go secure.
Web and Windows sharing: 80 and 443 are web; 445 is SMB, one more than 443 and not web at all.
Pairs the exam likes: 23 to 22, 80 to 443, 389 to 636, 143 to 993, 110 to 995, 514 to 6514, SNMP v2c to v3.

Practice these in CertStack. Scenario questions on secure protocol selection, firewall rules and log lines, with an explanation for every option.

Open CertStack

Source for port numbers: IANA Service Name and Transport Protocol Port Number Registry, checked 2026-09-25. IANA registration records the assignment, not what traffic on a port actually is or whether it is safe; the security notes are study guidance. Objectives: CompTIA Security+ SY0-701 exam objectives, version 5.0. Version 2026-09-25. Found a mistake? See corrections.