TL;DR: Learn ports in six job groups (web, mail, logon, naming, files, databases), not numeric order. The exam tests pairs that look alike: 22 vs 23, 25 vs 587, 161 vs 162, 67 vs 68, 389 vs 636. Every entry below matches the SecLern port bank, which is sourced from the official objectives and course notes.
Why ports decide questions
Ports show up in firewall rules, log lines, and attack scenarios. A question rarely asks "what is port 443" directly. It shows a firewall log with denied traffic to port 3389 from the internet and asks what to do, or it describes mail clients failing to send and names port 25 blocked outbound. The number is always wrapped in a job. So learn each port as a triple: number, protocol, job. The ports drill in the app tests exactly that triple.
A second reason: partial credit on matching sims. The port-service matching performance question rewards every correct pair, so even half the list memorized converts to points. Our PBQ strategy guide covers how to attack that sim type.
Group 1: web traffic (80, 443, 8080, 8443)
- 80 TCP, HTTP. Unencrypted web traffic. On the exam it is the "before" picture: credentials in cleartext, sessions hijackable, the reason HTTPS exists.
- 443 TCP, HTTPS. HTTP over TLS. The default allow for web servers and the port your firewall rule opens when the goal says "let users reach the site."
- 8080 TCP, HTTP alternate. Proxy servers and dev web apps live here. If a scenario mentions proxy traffic or an alternate web port, this is the number.
- 8443 TCP, HTTPS alternate. Same idea, encrypted. Admin panels and alternate TLS services sit here.
Trap note: 80 vs 443 is the exam's favorite "which rule fixes the site" pair. A rule allowing 80 when the policy demands encryption is wrong even though the site loads.
Group 2: mail (25, 587, 465, 110, 143, 993, 995)
- 25 TCP, SMTP. Server-to-server mail relay. Clients should not use it to submit mail anymore, which is exactly why "block outbound 25 except the mail server" is a standard anti-spam egress rule.
- 587 TCP, SMTP submission. Authenticated client mail submission with STARTTLS. When users cannot send mail from their laptops, check 587.
- 465 TCP, SMTPS. SMTP over implicit TLS. Older but still tested; know it as the implicit-TLS sibling of 587.
- 110 TCP, POP3. Mailbox download, cleartext. Downloads and usually deletes from the server.
- 143 TCP, IMAP. Mailbox sync, cleartext. Keeps mail on the server and syncs folders across devices.
- 993 TCP, IMAPS. IMAP over TLS. The secure answer whenever a scenario demands encrypted mailbox sync.
- 995 TCP, POP3S. POP3 over TLS. The secure sibling of 110.
Exam logic: anything without an S (25, 110, 143) moves credentials or content in cleartext; the S versions (465, 993, 995) wrap the same job in TLS. Port 587 is the odd one: submission by clients, STARTTLS rather than implicit TLS. Questions that say "mail client cannot send" point at 587 or 25; questions that say "mailbox sync must be encrypted" point at 993.
Group 3: remote logon and identity (22, 23, 3389, 88, 49, 389, 636, 1812, 1813)
- 22 TCP, SSH. Encrypted remote shell, plus SCP and SFTP file transfer. The secure replacement for Telnet and the correct answer for "administer the server securely."
- 23 TCP, Telnet. Cleartext remote terminal. On the exam Telnet is never the right answer for anything except "which protocol must be replaced" or "what caused the credential theft."
- 3389 TCP/UDP, RDP. Graphical remote control of Windows hosts. The exam treats internet-exposed RDP as an incident waiting to happen: gate it behind VPN, restrict source addresses, watch its logs.
- 88 TCP/UDP, Kerberos. Ticket-based network authentication. Appears in Windows domain logon scenarios and golden-ticket attack questions.
- 49 TCP/UDP, TACACS+. Cisco device AAA that encrypts the full payload. Contrast with RADIUS below.
- 389 TCP/UDP, LDAP. Directory queries in cleartext. Logons and address-book lookups use it; the exam flags it wherever credentials cross the wire unprotected.
- 636 TCP, LDAPS. LDAP over TLS. The fix for 389 in every "directory queries must be encrypted" scenario.
- 1812 UDP, RADIUS authentication. Encrypts the password only, not the whole packet. Classic exam contrast with TACACS+.
- 1813 UDP, RADIUS accounting. Usage records for the same sessions 1812 authenticates.
The AAA pair to drill cold: TACACS+ (49) encrypts everything and separates authentication, authorization, and accounting; RADIUS (1812/1813) encrypts only the password and combines authentication with authorization. The exam asks this distinction directly.
Group 4: naming, addresses, and time (53, 67, 68, 69, 123, 161, 162, 514, 500, 4500, 1194)
- 53 TCP/UDP, DNS. Lookups ride UDP; zone transfers ride TCP. DNS appears in firewall rules (allow 53 outbound or nothing resolves), log questions (odd TXT queries suggest tunneling), and exfiltration scenarios.
- 67 UDP, DHCP server. The server side. Remember server 67, client 68, by alphabetical order matching the words: server before client is wrong alphabetically, so instead remember the server gives (67) and the client gets (68).
- 68 UDP, DHCP client. The workstation side. Rogue-DHCP questions hinge on this pair: an unexpected server answering on 67 means starvation or spoofing attacks.
- 69 UDP, TFTP. Unauthenticated trivial file transfer for boot images and config backups. Its lack of authentication is the whole point of every TFTP question.
- 123 UDP, NTP. Time sync. Logs from machines with skewed clocks cannot be correlated, so NTP failure undermines the entire SIEM story.
- 161 UDP, SNMP manager polling. The manager asks devices how they feel.
- 162 UDP, SNMP traps. Devices shout when something breaks. Polling vs trap is the tested pair: scheduled questions answered by 161, alerting by 162.
- 514 UDP, Syslog. Log forwarding to the collector. A SIEM with no data usually means a 514 path problem.
- 500 UDP, IKE. Key exchange that sets up IPsec VPNs. Phase 1 lives here.
- 4500 UDP, IPsec NAT-T. Keeps IPsec working through NAT. If a tunnel works on open networks but dies behind home routers, NAT-T is the suspect.
- 1194 TCP/UDP, OpenVPN. The default tunnel port. Recognize it in "what VPN is this" log questions.
Group 5: files, sharing, and databases (20, 21, 135, 137, 138, 139, 445, 1433, 1521, 3306, 5432, 5060, 5061)
- 20 TCP, FTP data. Active-mode data channel. FTP splits control (21) from data (20), which confuses firewall rules that open only one.
- 21 TCP, FTP control. Cleartext credentials on the control channel. Replace with SFTP or FTPS wherever the scenario demands security.
- 135 TCP, RPC endpoint mapper. Windows services finding each other. Shows up in lateral-movement log questions.
- 137 UDP, NetBIOS name service. Name resolution on legacy Windows networks.
- 138 UDP, NetBIOS datagram. Connectionless NetBIOS chatter.
- 139 TCP, NetBIOS session. Legacy SMB sessions. The exam groups 137/138/139 as "old Windows networking" and 445 as its modern replacement.
- 445 TCP, SMB. File and print sharing, and the most abused lateral-movement target in the SecLern port list (WannaCry-style scenarios name it). Block 445 at boundaries; alert on it internally.
- 1433 TCP, MSSQL. Microsoft SQL Server. Database tiers accept it only from app servers, never from user networks.
- 1521 TCP, Oracle DB. Oracle listener. Same tiering logic as 1433.
- 3306 TCP, MySQL/MariaDB. Same tiering logic again; the exam loves "which port must the firewall open between web and DB tiers" with these numbers.
- 5432 TCP, PostgreSQL. Completes the database set. Four database ports, four vendors, one rule: databases listen to app servers only.
- 5060 TCP/UDP, SIP. VoIP call setup. Toll-fraud scenarios start with unexpected 5060 registrations.
- 5061 TCP, SIPS. SIP over TLS. Encrypted signaling for the same calls.
Exam-day port tactics
Read every port question twice: once for the number, once for direction and intent (open for service, block for attack, secure replacement). "Which port must the firewall allow for the replica to sync securely" is LDAPS 636 outbound: number plus direction plus secure variant. When two answers differ only by secure variant, the scenario's "securely" decides.
How to make the list stick
Lists do not stick; stories do. Nobody remembers 40 isolated numbers, but people remember "web traffic is 80 open, 443 locked" and "mail arrives on 25, you fetch it on 110/143, secured on 993/995". Learn ports as systems.
- Pairs. 20/21 FTP, 67/68 DHCP, 80/443 web, 110/143/993/995 mail, 389/636 LDAP/LDAPS. The exam's favorite trap is splitting a pair. Learn both halves together.
- Secure replacements. Telnet 23 to SSH 22, FTP 21 to SFTP 22, HTTP 80 to HTTPS 443, LDAP 389 to LDAPS 636, SNMP to SNMPv3. "Which should replace X" questions answer themselves from this ladder.
- UDP regulars. DNS 53 (both, UDP for queries), DHCP 67/68, TFTP 69, SNMP 161, syslog 514, NTP 123. If the question involves speed or connectionless delivery, check UDP first.
- Scenario-first rehearsal. For each port say the sentence, not the number: "DNS fails but ping 8.8.8.8 works, so port 53 is blocked." The ports drill tests that mapping.
Keep the weekly loop: read this sheet once on Monday, answer 10 quiz questions a day, and write the pairs and replacements from memory on Friday. Anything missed rejoins Monday's list.
How to drill them without burning out
Ten ports a day, triple format (number, protocol, job), with same-day recall of yesterday's ten. That pace covers the full bank in under a week. The ports drill schedules exactly this. Two rules make it stick: always recite the job with the number (never the number alone), and always pair traps together (22 with 23, 161 with 162, 389 with 636) so the difference gets rehearsed, not just the fact.
The five-second firewall read
Given any rule set on exam day: first find the goal sentence (which flows must pass, which must drop). Then map each named service to its port from this sheet. Then check direction and order: specific allows first, denies after, implicit deny last. Most wrong answers fail at step two, not step three. They allow the wrong port confidently. This sheet fixes step two.
Sources
- CompTIA Security+ certification page
- IANA service name and port number registry
- CompTIA SY0-701 exam objectives
By SecLern Editorial. Published October 18, 2026. Updated October 18, 2026. Port facts verified against the SecLern SY0-701 port bank (packs/sy0-701/ports.json).