CompTIA Security+ SY0-701: Ports and Protocols

Vocabulary practice flashcards covering core and supplemental networking ports, protocols, transport layers, security meanings, and firewall analysis for CompTIA Security+ SY0-701.

TCP (Transmission Control Protocol)

A connection-oriented transport protocol that provides reliable, ordered packet delivery; commonly used by SSH, HTTPS, RDP, and SMB.

UDP (User Datagram Protocol)

A connectionless transport protocol that transmits datagrams without a built-in reliability guarantee; commonly used by DHCP, NTP, SNMP, DNS queries, and QUIC-based HTTPS.

System / Well-Known Ports

The port range from 0 to 1023, assigned to core services such as DNS (53) and HTTPS (443).

User / Registered Ports

The port range from 1024 to 49151, assigned to application services such as RDP (3389) and Microsoft SQL Server (1433).

Dynamic / Private Ports

The port range from 49152 to 65535, frequently used by clients as temporary source ports and available for configurable services.

(Port 22)

SSH / SFTP Uses TCP/22 to provide encrypted remote shell sessions and secure file transfers over SSH; preferred secure alternative to Telnet.

(Port 23)

Telnet Uses TCP/23 to provide remote terminal access in cleartext; insecure legacy protocol that should be replaced with SSH.

(Port 80)

HTTP Uses TCP/80 for web traffic without inherent transport encryption; should be replaced with HTTPS.

(Port 443)

HTTPS Uses TCP/443 (or UDP/443 for QUIC in HTTP/3) to deliver TLS-protected web communications.

(Port 3389)

RDP Remote Desktop Protocol operating on TCP/3389 (and also UDP); exposure should be restricted behind an approved VPN, remote desktop gateway, and MFA.

(Port 20)

FTP Data Uses TCP/20 for traditional active-mode FTP data connections; passive FTP does not always use port 20.

(Port 21)

FTP Control Uses TCP/21 for transmitting commands and logins in cleartext; explicit FTPS can also use this port.

(Port 69)

TFTP Trivial File Transfer Protocol operating over UDP/69 for simple file transfers without built-in authentication or encryption.

(Port 445)

SMB Server Message Block operating over TCP/445 for Windows file sharing; must avoid internet exposure to prevent lateral movement.

(Ports 989 / 990)

Implicit FTPS Legacy file transfer protocol using TCP/989 for data and TCP/990 for control, protected implicitly with TLS.

(Port 53)

DNS Domain Name System operating on UDP and TCP 53; common queries use UDP, while TCP is used for zone transfers and larger exchanges.

(Ports 67 / 68)

DHCPv4 Dynamic Host Configuration Protocol for IPv4 operating over UDP; the server listens on UDP/67, while the client uses UDP/68 to obtain configuration.

(Port 88)

Kerberos Enterprise identity and authentication service commonly used in Windows environments, operating over TCP and UDP 88.

(Port 123)

NTP Network Time Protocol operating over UDP/123 to provide clock synchronization, essential for log correlation and Kerberos authentication.

(Port 25)

SMTP Relay Uses TCP/25 primarily for server-to-server email forwarding; TLS may be negotiated, but it is not the recommended standard for end-user mail submission.

(Port 110)

POP3 Post Office Protocol version 3 using TCP/110 for unencrypted email retrieval; commonly replaced by POP3S.

(Port 143)

IMAP Internet Message Access Protocol operating over TCP/143 to synchronize mailboxes; can be secured using STARTTLS over this same port.

(Port 465)

SMTP Submission TLS / SMTPS Uses TCP/465 for client email message submission protected by implicit TLS.

(Port 587)

SMTP Submission Standard TCP port for client email message submission, commonly secured using STARTTLS.

(Port 993)

IMAPS Internet Message Access Protocol secured with implicit TLS, operating on TCP/993.

(Port 995)

POP3S Post Office Protocol version 3 secured with implicit TLS, operating on TCP/995.

(Port 49)

TACACS+ Terminal Access Controller Access-Control System Plus operating over TCP/49 for centralized network device administration and granular command authorization.

(Port 135)

Microsoft RPC Endpoint Mapper Uses TCP/135 for Windows RPC service discovery; client requests can be negotiated and redirected to additional dynamic RPC ports.

(Ports 137 / 138 / 139)

NetBIOS Legacy Windows networking services operating on UDP/137 (name), UDP/138 (datagram), and TCP/139 (session); should be restricted when unneeded.

(Ports 161 / 162)

SNMP / SNMP Traps Simple Network Management Protocol operating on UDP/161 for management queries and UDP/162 for alerts/traps; SNMPv3 provides authentication and privacy on these same ports.

(Port 389)

LDAP Lightweight Directory Access Protocol operating over TCP (and UDP) 389 for directory lookups; can be secured with STARTTLS.

(Port 514)

Syslog Traditional centralized system logging protocol operating over UDP/514 with no built-in encryption.

(Port 636)

LDAPS Lightweight Directory Access Protocol over TLS, operating over TCP/636 on a separate secure listener.

(Ports 1812 / 1813)

Standard RADIUS Officially assigned RADIUS ports using UDP/1812 for authentication/authorization and UDP/1813 for accounting records.

(Ports 1645 / 1646)

Legacy RADIUS Older, non-standard RADIUS ports using UDP/1645 for authentication and UDP/1646 for accounting; replaced by standard UDP 1812/1813.

(Port 6514)

Syslog over TLS Encrypted centralized logging protocol operating over TCP/6514, providing confidentiality, integrity, and certificate-validated transport.

(Port 500)

IKE / IPsec Internet Key Exchange operating over UDP/500 to negotiate security associations and encryption keys for IPsec VPNs.

ESP and AH (IP Protocols 50 and 51)

Encapsulating Security Payload (50) and Authentication Header (51); core IPsec network protocols that operate directly over IP, not via TCP or UDP ports.

(IP Protocol 47)

GRE Generic Routing Encapsulation; an IP protocol number (47), not a transport-layer port, used to carry tunnel traffic for VPNs such as PPTP.

(Port 119)

NNTP Network News Transfer Protocol operating over TCP/119 for Usenet newsgroups; legacy transport is not encrypted by default.

(Ports 546 / 547)

DHCPv6 Dynamic Host Configuration Protocol for IPv6 operating over UDP; client messages use UDP/546 and server listeners use UDP/547.

(Port 1433)

Microsoft SQL Server Database listener listening on TCP/1433; network access must be restricted to authorized application hosts.

(Ports 5060 / 5061)

SIP / SIP over TLS Session Initiation Protocol used for VoIP call signaling; plain SIP runs over UDP or TCP 5060, while SIP over TLS typically uses TCP/5061.

Five-Tuple

The standard set of network traffic attributes used in firewall rules and connection logs: source IP, source port, destination IP, destination port, and transport protocol.

DNSSEC

A security extension that provides origin authentication and integrity validation for DNS records through digital signatures; distinct from DNS transport encryption (DoT/DoH).