Ports and protocols matter because defenders must recognize which service should be communicating and whether the connection is authorized. Memorizing a port number alone cannot tell an analyst whether encrypted traffic is safe, whether an internal service is exposed or whether a malicious process is using an allowed protocol. This guide connects familiar network-service defaults to identity, transport security and operational investigation. Actual deployments can use nondefault ports, and network policy should be validated against the service’s real behavior.

Why Port and Protocol Knowledge Matters for Security Professionals

Security professionals who do not understand ports and protocols are at a serious disadvantage when it comes to tasks like configuring firewalls, analyzing packet captures, or responding to intrusion alerts. When a firewall rule needs to be written to block a specific type of traffic, the administrator must know exactly which port number and transport protocol to target. When a network analyst reviews logs showing unusual activity on port 443, they need to know that this is HTTPS traffic and consider what might be hiding inside encrypted web sessions.

The SY0-701 exam reflects this practical reality by weaving port and protocol knowledge into questions about access control, network segmentation, vulnerability assessment, and incident response. Candidates who treat ports and protocols as mere memorization material often struggle with application-layer questions. Those who genuinely understand the relationship between services, their ports, and their security implications are far better prepared to answer the kind of scenario-driven questions that define the modern Security+ exam format.

From a security perspective, this distinction carries real weight. TCP’s three-way handshake can be exploited in SYN flood attacks, where an attacker sends a high volume of connection requests without completing the handshake, overwhelming the target. UDP, lacking a connection mechanism, is commonly used in amplification attacks where small requests generate large responses directed at a victim. The SY0-701 exam expects candidates to associate specific protocols with TCP, UDP, or both, and to understand the security implications of each transport method.

File Transfer Protocols and the Ports They Occupy

FTP control connections conventionally use TCP port 21; in active mode the server may initiate a data connection from TCP port 20, while passive mode negotiates a separate data endpoint. Plain FTP can expose credentials and content when not otherwise protected. A Security+ candidate should recognize the difference between the control channel and negotiated data channel rather than assume that every FTP transfer always uses only ports 20 and 21.

SFTP (SSH File Transfer Protocol) commonly uses the SSH service on TCP port 22; despite its name, it is not FTP with an added security flag. FTPS adds TLS to the FTP protocol. Explicit FTPS generally begins on TCP port 21 and negotiates TLS using AUTH TLS as specified in RFC 4217. Legacy implicit FTPS deployments commonly use TCP 990 for control and 989 for data, but modern firewall planning must also account for negotiated FTP data connections. These are deployment distinctions, not interchangeable port numbers.

Remote access is a cornerstone of modern network administration, and the protocols that enable it are heavily tested on the Security+ exam. Secure Shell (SSH) commonly uses TCP port 22 by default, although administrators can configure another port; it provides an encrypted channel for remote administration. It replaced the older Telnet protocol, which operates on port 23 and sends all data including usernames and passwords in plaintext. Any security-conscious administrator avoids Telnet on production systems, and the exam consistently reinforces this point.

Web Traffic Protocols That Dominate Network Activity

HTTP and HTTPS are application protocols, not proof of safety from a port number. Plain HTTP commonly uses TCP 80, while HTTPS over HTTP/1.1 or HTTP/2 commonly uses TLS on TCP 443. HTTP/3 carries HTTP semantics over QUIC, frequently on UDP 443, with TLS protection integrated into QUIC. A firewall or packet-capture exercise must therefore distinguish TCP from UDP and verify the real service, certificate identity and access policy; observing port 443 alone cannot establish that the traffic is authorized.

SMTP uses TCP port 25 primarily for server-to-server message relay. For authenticated message submission, TCP port 587 commonly uses STARTTLS, while TCP port 465 is standardized for submission with TLS established immediately on connection. RFC 8314 recommends implicit TLS where practical and recognizes both secure submission modes when clients validate certificates and require successful TLS negotiation. Port 465 has not simply been replaced by 587; a security question should identify whether the traffic is relay or submission and how TLS is enforced.

POP3 and IMAP are established mail-retrieval protocols. Traditional unencrypted service ports are TCP 110 for POP3 and TCP 143 for IMAP; implicit TLS commonly uses TCP 995 for POP3 and TCP 993 for IMAP. STARTTLS can also upgrade connections where supported and required by policy. An operator must verify that the client validates the server certificate and fails closed when TLS cannot be established rather than assuming a familiar port proves confidentiality.

Domain Name System and Its Role in Security Attacks

DNS, the Domain Name System, operates primarily on port 53 using UDP for standard queries and TCP for zone transfers and larger responses. It translates human-readable domain names into IP addresses and is a critical component of virtually every networked application. From a security standpoint, DNS is a frequent target and tool for attackers because it is almost always allowed through firewalls and trusted by default.

DNS poisoning attempts to influence a resolver or client into accepting a false answer, while DNS tunneling can encode data in queries to bypass ordinary application channels. DNSSEC lets a validating resolver verify signed DNS records and detect certain tampering or forgery; it does not encrypt DNS queries or decide which resolver an endpoint should trust. For Security+ preparation, distinguish DNS data integrity, query privacy and endpoint resolver policy instead of treating DNSSEC as universal network encryption.

SNMP, the Simple Network Management Protocol, is used to monitor and manage network devices like routers, switches, and servers. It operates on UDP ports 161 for polling and 162 for trap notifications. Earlier versions of SNMP, particularly version 1 and version 2c, use community strings for authentication that are transmitted in plaintext. The community string “public” for read access is a well-known default that attackers routinely attempt. SNMPv3 introduced proper encryption and authentication, and the exam expects candidates to know that earlier versions should be avoided or secured.

When a client receives an unexpected DNS answer, the useful next step is not to repeat the memorized port number: determine which resolver answered, whether the endpoint followed enterprise resolver policy, and whether signed responses were validated where applicable. The secure DNS model distinguishes integrity of published DNS data, confidentiality of resolver transport and the endpoint’s choice of trusted resolver. A legitimate-looking port-53 flow cannot by itself settle those questions; record the query name, response path and relevant policy before making a security decision.

Kerberos and Authentication Protocol Port Numbers

Kerberos is the primary authentication protocol used in Windows Active Directory environments, and it operates on port 88 using both TCP and UDP. It provides mutual authentication between clients and servers using a ticket-based system managed by a Key Distribution Center. Rather than transmitting passwords across the network, Kerberos issues encrypted tickets that prove identity for a limited time period. This design significantly reduces the risk of credential interception compared to older authentication methods.

Kerberos has well-known attack patterns whose success depends on specific access and account conditions. Pass-the-ticket means replaying stolen authentication material. Kerberoasting targets service-ticket material that can be tested against weak service-account secrets offline. A Golden Ticket is a forged ticket-granting ticket made with a compromised KRBTGT key, potentially enabling extensive impersonation in the affected domain; it is not literally unlimited access to every resource or every independent domain. Defenders protect service accounts, restrict privileged access, monitor anomalies, and plan KRBTGT key rotation after confirmed compromise.

Syslog is the standard protocol for transmitting log messages from network devices, servers, and security appliances to a centralized logging server. It operates on UDP port 514 for standard transmission and TCP port 6514 when used with TLS for encrypted log forwarding. Centralized logging is a core component of any security operations program because it enables correlation of events across multiple systems, supports incident investigation, and provides evidence for compliance audits.

VPN Protocols and Encrypted Tunnel Port Numbers

Virtual Private Networks often use IPsec and IKE. IKE negotiation commonly uses UDP port 500, and NAT traversal commonly uses UDP 4500. With ESP transport mode, the original IP header remains outside the encrypted payload; with tunnel mode, an entire inner IP packet can be protected and carried within a new outer IP packet whose header remains observable. Actual ports, NAT traversal and authentication should be verified from the deployment rather than assumed from a memorized list.

OpenVPN commonly uses UDP port 1194 by default but is configurable to use different ports and transports. WireGuard commonly listens on UDP 51820 in example/default deployments but can be configured for another UDP port. Many TLS-based remote-access VPN gateways use TCP 443, but browser-based access is not a defining property of every SSL VPN. For exam scenarios and operational response, identify the configured service, transport, endpoint identity and security boundary rather than relying solely on the advertised port.

Database ports are valuable exposure clues, not universal evidence of a flaw. Microsoft SQL Server often uses TCP 1433, MySQL TCP 3306, PostgreSQL TCP 5432, and Oracle listeners commonly TCP 1521. Direct public access to a database should require a documented business justification, restrictive network controls, strong authentication, TLS where supported and monitoring. An unrestricted listener exposed to the internet is a serious security concern; a carefully controlled endpoint should be evaluated against its actual authorization and threat model rather than called vulnerable solely because its port is reachable.

ICMP and Its Dual Role in Networking and Attacks

ICMP, the Internet Control Message Protocol, is technically not associated with a port number because it operates at the network layer rather than the transport layer. However, it appears on the Security+ exam because of its significant role in both network diagnostics and attack techniques. The ping utility uses ICMP echo requests and replies to test connectivity, and traceroute uses ICMP time-exceeded messages to map network paths.

Attackers exploit ICMP in several ways that candidates must recognize. ICMP tunneling allows data to be smuggled inside ICMP packets, bypassing firewalls that do not perform deep packet inspection. ICMP flood attacks overwhelm targets with large volumes of echo requests, consuming bandwidth and processing resources. Ping of death attacks, largely historical but still referenced in exam content, involve sending malformed oversized ICMP packets to crash vulnerable systems. Many security-conscious organizations restrict ICMP at their perimeter while allowing it internally for diagnostic purposes.

RADIUS, the Remote Authentication Dial-In User Service, is the most common protocol used for centralized authentication of network access requests, including wireless clients, VPN users, and wired network port access through 802.1X. RADIUS operates on UDP ports 1812 for authentication and 1813 for accounting, though older implementations sometimes used ports 1645 and 1646. It communicates with network access servers and forwards authentication requests to a central directory service.

In SY0-701 scenarios about network services, a default port is a clue rather than proof of a service’s security. An HTTPS connection on 443 may still carry an unauthorized API request; DNS queries on 53 can be legitimate or suspicious depending on source, name and policy. Identify the protocol, expected peer and authorization boundary before deciding what to block.

Putting It All Together With a Port-Based Security Mindset

Approaching port and protocol knowledge with a security mindset means more than memorizing a list of numbers. It means thinking about every port as either a necessary service to protect or an unnecessary exposure to close. Security professionals apply this thinking when conducting port scans with tools like Nmap, reviewing firewall rule sets, or interpreting vulnerability scanner output. Recognizing which services are running on which ports allows for informed decisions about what to allow, what to block, and what requires additional protection measures.

A useful hypothetical Security+ scenario is a server exposing FTP on TCP 21, Telnet on TCP 23 and HTTP on TCP 80. The candidate must ask what business service each port serves, whether credentials or sensitive data cross it, and whether secure alternatives such as SFTP, SSH or HTTPS can replace the plaintext channel. Do not assume merely moving a service to a different port provides security: authentication, encryption, policy and business purpose remain the relevant controls.

Building Exam Confidence Through Consistent Port Review

The most effective way to retain port and protocol information for the Security+ exam is through consistent, spaced repetition combined with contextual learning. Flashcards that pair port numbers with their associated services and security notes are a proven study tool, but they work best when supplemented with practice scenarios that require applying the knowledge rather than simply recalling it. Working through practice exam questions that involve network diagrams, firewall configurations, and incident response scenarios reinforces the connections between port numbers and their real-world security implications.

Candidates should also take time to group ports by category, such as email protocols, file transfer protocols, remote access protocols, and directory services, because the exam often tests related concepts together. Reviewing past vulnerabilities and notable attacks associated with specific protocols helps create memorable associations that stick far better than dry memorization. Every hour spent connecting port numbers to security concepts is an hour that builds both exam readiness and the practical knowledge that will serve in a real security career.

Port literacy remains relevant after certification, but a memorized service-to-port table is only the start. A security analyst needs current deployment evidence, authorized service baselines and a way to distinguish expected encrypted communication from an allowed channel used incorrectly.

A reliable ports-and-protocols reference supports traffic interpretation and access-control decisions. Verify actual configurations, encrypted alternatives and business purpose; do not infer trust from a familiar port number or claim that a memorized table replaces network investigation.