Reference · SY0-801 and SY0-701
The default ports behind the services CompTIA Security+® questions talk about, what each one is for, and the secure option to pick instead. Learn the swaps, filter the table, then quiz yourself.
Secure swaps
When a question asks for the most secure way to run a service, the answer is often the encrypted version of the same thing. These are the swaps to know cold.
Replace Telnet on port 23 with SSH on port 22. Encrypts the whole session, password included.
Replace HTTP on port 80 with HTTPS on port 443. TLS protects pages, cookies and form data.
Replace FTP on port 20, 21 with SFTP or FTPS on port 22 or 990. SFTP runs inside SSH; FTPS wraps FTP in TLS.
Replace LDAP on port 389 with LDAPS on port 636. Directory binds and lookups travel inside TLS.
Replace SNMPv1/v2c on port 161, 162 with SNMPv3 on port 161, 162. Same ports; version 3 adds authentication and encryption.
Replace POP3 on port 110 with POP3S on port 995. Mail downloads, and the password, inside TLS.
Replace IMAP on port 143 with IMAPS on port 993. Mailbox access inside TLS.
Replace Syslog on port 514 with Syslog over TLS on port 6514. Logs can't be read or altered in transit.
Replace SIP on port 5060 with SIP over TLS on port 5061. Encrypted call setup; SRTP protects the audio.
Replace DNS on port 53 with DNS over TLS on port 853. Hides lookups from anyone on the path.
SNMP is the odd one out: version 3 keeps the same ports and adds security, so the fix is the version, not the port.
Port list
Default ports for the services you’re most likely to meet. A service can be moved to another port, so treat a port number as a clue, not proof.
Showing all 43 ports
| Port | Service | What it’s for | Secure option |
|---|---|---|---|
| 20, 21TCP | FTPPlain text | File transfer: 21 carries commands, 20 carries data in active mode. Everything, including the password, is in plain text. | Secure option: SFTP (22) or FTPS (990) |
| 22TCP | SSH, SFTP, SCPEncrypted | Encrypted remote command line. SFTP and SCP file transfers run inside SSH on the same port. | Secure option: Already encrypted. Use key-based sign-in and turn off password logins where you can. |
| 23TCP | TelnetPlain text | Unencrypted remote command line; anyone on the path can read the session, password included. | Secure option: SSH (22) |
| 25TCP | SMTPPlain text | Mail servers relaying email to each other. | Secure option: STARTTLS between servers; clients send mail on 587 or 465 instead |
| 49TCP | TACACS+Encrypted | Central sign-in and command authorization for network devices. | Secure option: Encrypts the whole message body, unlike RADIUS |
| 53UDP, TCP | DNSPlain text | Name lookups on UDP; TCP for zone transfers and large answers. | Secure option: DNS over TLS (853) or DNS over HTTPS (443); DNSSEC adds signed records |
| 67, 68UDP | DHCPPlain text | Hands out IP addresses: the server listens on 67, clients on 68. | Secure option: No encrypted version; use DHCP snooping on switches to block rogue servers |
| 69UDP | TFTPPlain text | Bare-bones file transfer with no sign-in, used to load device configs and boot images. | Secure option: SFTP (22) or SCP |
| 80TCP | HTTPPlain text | Unencrypted web traffic. | Secure option: HTTPS (443) |
| 88TCP, UDP | KerberosEncrypted | Ticket-based sign-in, used by Active Directory. | Secure option: Tickets are already encrypted; protect the domain controllers |
| 110TCP | POP3Plain text | Downloads email from a mail server, in plain text. | Secure option: POP3S (995) |
| 123UDP | NTPPlain text | Keeps clocks in sync, which log timelines and Kerberos depend on. | Secure option: Authenticated NTP or Network Time Security (NTS) |
| 137–139UDP, TCP | NetBIOSPlain text | Legacy Windows name, datagram and session services. | Secure option: Turn it off where it isn't needed; modern Windows file sharing uses SMB on 445 |
| 143TCP | IMAPPlain text | Reads and syncs email kept on the server, in plain text. | Secure option: IMAPS (993) |
| 161, 162UDP | SNMPPlain text | Device monitoring: managers poll agents on 161, and agents send traps to 162. | Secure option: SNMPv3 on the same ports; v1 and v2c send community strings in plain text |
| 389TCP, UDP | LDAPPlain text | Directory lookups and changes, for example against Active Directory. | Secure option: LDAPS (636), or StartTLS on 389 |
| 443TCP, UDP | HTTPSEncrypted | Web traffic inside TLS; HTTP/3 runs over UDP 443. | Secure option: Already encrypted. Keep TLS versions and certificates current. |
| 445TCP | SMBPlain text | Windows file and printer sharing. | Secure option: Use SMB 3 encryption and never expose 445 to the internet |
| 465TCP | SMTPS (submission)Encrypted | Mail clients sending email over TLS from the first byte (implicit TLS). | Secure option: Already encrypted |
| 500UDP | IKE (IPsec)Encrypted | Negotiates the keys for an IPsec VPN tunnel. | Secure option: Part of IPsec; UDP 4500 carries IPsec through NAT |
| 514UDP | SyslogPlain text | Devices and servers sending log messages to a collector, in plain text. | Secure option: Syslog over TLS (6514) |
| 587TCP | SMTP submissionEncrypted | Mail clients sending email to their server, upgraded with STARTTLS. | Secure option: Require STARTTLS and authentication |
| 636TCP | LDAPSEncrypted | LDAP inside TLS. | Secure option: Already encrypted |
| 853TCP | DNS over TLSEncrypted | Encrypted DNS lookups between a client and its resolver. | Secure option: Already encrypted |
| 989, 990TCP | FTPS (implicit TLS)Encrypted | FTP inside TLS: 990 for commands, 989 for data. | Secure option: Already encrypted |
| 993TCP | IMAPSEncrypted | IMAP inside TLS. | Secure option: Already encrypted |
| 995TCP | POP3SEncrypted | POP3 inside TLS. | Secure option: Already encrypted |
| 1433TCP | Microsoft SQL ServerPlain text | The default port for SQL Server databases. | Secure option: Require encrypted connections and keep it off the internet |
| 1521TCP | Oracle DatabasePlain text | The default Oracle database listener. | Secure option: Require encrypted connections and keep it off the internet |
| 1701UDP | L2TPPlain text | A VPN tunnel that doesn't encrypt anything on its own. | Secure option: Pair it with IPsec (L2TP/IPsec) |
| 1723TCP | PPTPPlain text | An old VPN protocol with broken security. | Secure option: IPsec or TLS-based VPNs |
| 1812, 1813UDP | RADIUSPlain text | Central sign-in for Wi-Fi, VPN and network access: 1812 for authentication, 1813 for accounting. | Secure option: Only the password field is hidden; RadSec runs RADIUS inside TLS |
| 3306TCP | MySQLPlain text | The default MySQL and MariaDB database port. | Secure option: Require TLS connections and keep it off the internet |
| 3389TCP, UDP | RDPEncrypted | Windows Remote Desktop; a favorite target when it's open to the internet. | Secure option: Encrypted, but put it behind a VPN or gateway with MFA and Network Level Authentication |
| 4500UDP | IPsec NAT traversalEncrypted | Carries IPsec traffic through devices that do NAT. | Secure option: Part of IPsec |
| 5060TCP, UDP | SIPPlain text | Sets up voice and video calls, in plain text. | Secure option: SIP over TLS (5061), with SRTP for the media |
| 5061TCP | SIP over TLSEncrypted | Encrypted call setup. | Secure option: Already encrypted; protect the media with SRTP |
| 5432TCP | PostgreSQLPlain text | The default PostgreSQL database port. | Secure option: Require TLS connections and keep it off the internet |
| 5900TCP | VNCPlain text | Remote desktop sharing; extra screens use 5901, 5902 and so on. | Secure option: Tunnel it through SSH or a VPN |
| 5985, 5986TCP | WinRMPlain text | Windows Remote Management, often used by PowerShell remoting: 5985 over HTTP, 5986 over HTTPS. | Secure option: Use 5986 (HTTPS) |
| 6514TCP | Syslog over TLSEncrypted | Sending logs to a collector inside TLS. | Secure option: Already encrypted |
| 8080TCP | HTTP alternatePlain text | A common extra port for web servers, proxies and admin consoles, in plain text. | Secure option: 8443 or 443 with TLS |
| 8443TCP | HTTPS alternateEncrypted | A common extra port for TLS-protected web apps and admin consoles. | Secure option: Already encrypted |
No ports match.
In our map of the SY0-801 objectives, choosing secure protocols and ports sits under 4.1, and open or unneeded services as an attack surface under 2.4. See the exam objectives checklist.
Port basics
Every TCP and UDP port number falls into one of three ranges. Servers listen on well-known or registered ports; your computer picks a dynamic port for its side of each connection.
The bands aren’t to scale: the well-known range is under 2% of all port numbers.
Every port belongs to a transport. Some services, like DNS, use both.
| Feature | TCP | UDP |
|---|---|---|
| Connection | Three-way handshake first | None, just send |
| Delivery | Checked, ordered, resent if lost | Best effort, can drop packets |
| Speed | More overhead | Less overhead, lower delay |
| Typical uses | Web, email, SSH, RDP, databases | DNS lookups, DHCP, NTP, SNMP, syslog, VoIP media |
Self-quiz
We show a port number, you pick the service that uses it by default. Ten ports a round, drawn from the table above.
Port 443 TCP
Which service uses this port by default?
Rounds are random, so the next one will be different.
The quiz needs JavaScript. Every answer is in the table above, and the flashcards page lists every port card.
FAQ
Know the common services and their secure versions: 22 SSH, 23 Telnet, 25 SMTP, 53 DNS, 80 HTTP, 443 HTTPS, 389 LDAP and 636 LDAPS, 3389 RDP and the email ports. In our map of the SY0-801 objectives, ports come up as choosing secure protocols (4.1) and spotting open, unneeded services (2.4), so learn what each port is for, not just its number.
SFTP uses port 22, because it runs inside an SSH connection. Don’t confuse it with FTPS, which is FTP with TLS: it uses port 990 for implicit TLS, or port 21 when the client asks to upgrade to TLS.
TCP sets up a connection with a handshake and guarantees checked, ordered delivery. UDP just sends datagrams, so it’s lighter and faster but can lose packets. Web, email and SSH use TCP; DNS lookups, DHCP, NTP, SNMP and classic syslog use UDP.
No. SNMPv3 uses the same ports as versions 1 and 2c: UDP 161 for queries and UDP 162 for traps. What changes is security: version 3 adds authentication and encryption, while 1 and 2c send their community strings in plain text.
Ports for protocols that send data, passwords included, in plain text: 21 FTP, 23 Telnet, 80 HTTP, 110 POP3, 143 IMAP, 389 LDAP without StartTLS, and SNMP versions 1 and 2c. Choose the encrypted alternatives in the table, and close any port a system doesn’t need.
Mock Test 1 is a free, full-length SY0-801 practice exam. Every option is explained, so you learn why one protocol beats another.
