Security+ Port Questions Want the Secure Swap

Plenty of people create a deck of forty port numbers to memorize and still struggle with the port questions on the SY0-701 exam. The deck works well for its purpose, but the test doesn't usually ask just for the number. Instead, it might mention a protocol that transmits data in plain text and ask what should be used instead, or show a firewall rule and ask what's wrong with it.

That's objective 4.5, where secure protocol selection sits right next to firewall rules. So the thing worth learning is the swap: the insecure protocol, the secure counterpart that replaces it, and which port each one uses.

Learn the pairs, not the list

A simple list treats all numbers equally, which can make them hard to remember. With pairs, each number has a partner that helps explain it. You should know these swaps well.

• Telnet uses port 23 and switches to SSH on port 22.
• HTTP runs on port 80 and changes to HTTPS on port 443.
• FTP operates on ports 20 and 21, and can switch to SFTP on port 22 or FTPS on ports 989 and 990.
• LDAP works on port 389 and moves to LDAPS on port 636.
• POP3 uses port 110 and changes to POP3S on port 995; similarly, IMAP on port 143 becomes IMAPS on port 993.
• SMTP runs on port 25 and can switch to submission on port 587 with STARTTLS, or to SMTPS on port 465 with TLS from the start.
• Syslog sends on port 514 and moves to syslog over TLS on port 6514.

Once the pair is the unit, many questions become clear. An admin handling switch management via Telnet should use SSH. A directory lookup that travels across the network in plain text should use LDAPS. You're finishing a pair you already know half of, which is much easier than trying to find one number out of forty.

Two traps where the fix isn't a new port

Most swaps lead to another port, making it simple to think they all do. However, two of the most tested ones don't, and the incorrect answers are built on that misunderstanding.

The first is SNMP. In versions 1 and 2c, community strings travel in plain text over UDP ports 161 and 162. SNMPv3 remedies this by incorporating authentication and encryption, still using those same two ports. So an option to switch SNMP to a secure port is incorrect. The solution lies in upgrading the version.

The second is DNS, with a twist. Traditional DNS on port 53 lacks encryption, meaning anyone along the route can see your queries. DNSSEC, which sounds like it might help, only signs DNS records to detect fake responses; it doesn't encrypt anything, so lookups remain visible. Encrypting the actual query is done by DNS over TLS (DoT) on port 853 or DNS over HTTPS (DoH) on port 443. If a question asks how to prevent others from seeing which sites a user looks up, DoT or DoH is the answer. To stop fake responses, DNSSEC is the solution. Both are part of DNS security but address different issues.

SFTP and FTPS are not the same thing

Both are known as secure FTP, and the exam leans on that confusion. SFTP works within SSH for file transfer and isn't related to the FTP protocol, so it uses port 22, which is also used by SSH and SCP. FTPS is standard FTP encrypted with TLS, and it operates on ports 989 and 990.

That difference raises a real question. In a scenario where the firewall only allows port 22 outbound, SFTP will function but FTPS won't. If the organization desires one open port for remote shell and file transfer, the choice is SSH, as SFTP and SCP use that port too.

Where ports show up in a firewall rule

You'll find port numbers in rule tables, often in a performance-based question. The task here is to look at each rule and figure out if that particular traffic should pass through.

A few rules stand out. An inbound Telnet allow on port 23 from any source is a problem because it's unencrypted. Allowing Remote Desktop Protocol (RDP) on port 3389 from the internet is an issue too, and this one often catches people out. Even though RDP is encrypted, RDP exposed to the internet is a leading entry point for ransomware. Just being encrypted doesn't mean it's safe to expose. The rule table is testing exposure, not only encryption.

How to drill it

Write down the insecure part of each pair first, then add the secure counterpart and its port number. Next, reverse the order. Begin with the secure protocol and explain what it replaced. Finally, say out loud what each secure version adds, whether that's encryption, authentication, or integrity, because that detail is what separates DNSSEC from DoT.

Once that's solid, read ports inside real rules instead of on their own. A free firewall rule question will tell you quickly if the pairs hold up when mixed with source addresses and directions. The full port table, including less common ports, is worth a single pass once the pairs are solid. CompTIA's wording for objective 4.5 is listed in the objectives as well.

When a question mentions a cleartext protocol, start by looking for its paired protocol first. If the question names SNMP or DNS, pause and verify whether the solution involves a newer version of the protocol or an alternative one before proceeding.