Security+ Ports and Protocols Cheat Sheet (SY0-701)
The 58 well-known ports and protocols to know for the CompTIA Security+ SY0-701 exam, grouped by service, with the secure and insecure pairs flagged. Free, no account needed. Download the one-page PDF or study it right here.
Last updated August 2026
Secure vs insecure protocol pairs
A favorite exam pattern: given a cleartext protocol, name its encrypted replacement and port. These are the pairs worth memorizing cold.
| Insecure | Port | Secure replacement | Port |
|---|---|---|---|
| HTTP | 80 | HTTPS | 443 |
| FTP | 20/21 | SFTP or FTPS | 22 or 989/990 |
| Telnet | 23 | SSH | 22 |
| SMTP | 25 | SMTPS or submission | 465 or 587 |
| POP3 | 110 | POP3S | 995 |
| IMAP | 143 | IMAPS | 993 |
| LDAP | 389 | LDAPS | 636 |
| DNS | 53 | DoH or DoT | 443 or 853 |
| SNMP v1/v2c | 161/162 | SNMPv3 | 161/162 |
| Syslog | 514 | Syslog over TLS | 6514 |
| TFTP | 69 | SFTP or SCP | 22 |
| PPTP | 1723 | IPsec IKEv2 | 500 and 4500 |
| VNC | 5900 | RDP or SSH tunnel | 3389 or 22 |
| WinRM over HTTP | 5985 | WinRM over HTTPS | 5986 |
| SIP | 5060 | SIP over TLS | 5061 |
Full ports and protocols reference
Grouped by service. Cleartext protocols are flagged so you know which ones the exam expects you to replace.
| Port | Protocol | Security |
|---|---|---|
| Web | ||
| 80TCP | HTTP Hypertext Transfer ProtocolCleartext web traffic. Anyone on the path can read or modify it. Replaced by HTTPS on 443. | Cleartext |
| 443TCP | HTTPS HTTP over TLSHTTP secured with TLS. The default for modern web traffic and the transport for DoH and many TLS tunnels. | Secure |
| 8080TCP | HTTP alternate HTTP proxy and alternate web portWhere proxies and app servers park a second cleartext web listener. Same exposure as 80, easier to forget in a firewall review. | Cleartext |
| 8443TCP | HTTPS alternate HTTPS on a non-standard portTLS on an alternate port, common for management consoles and appliance web interfaces. | Secure |
| 25TCP | SMTP Simple Mail Transfer ProtocolServer-to-server mail relay, historically cleartext. Clients should submit mail on 587 (STARTTLS) or 465 (implicit TLS). | Cleartext |
| 587TCP | SMTP submission Mail submission with STARTTLSAuthenticated client mail submission, upgraded to TLS with STARTTLS. The modern send port. | Secure |
| 465TCP | SMTPS SMTP over TLS (implicit)SMTP wrapped in TLS from the first byte (implicit TLS). | Secure |
| 110TCP | POP3 Post Office Protocol v3Downloads mail to the client in cleartext. Secure version is POP3S on 995. | Cleartext |
| 995TCP | POP3S POP3 over TLSPOP3 wrapped in SSL/TLS. | Secure |
| 143TCP | IMAP Internet Message Access ProtocolServer-side mailbox access in cleartext. Secure version is IMAPS on 993. | Cleartext |
| 993TCP | IMAPS IMAP over TLSIMAP wrapped in SSL/TLS. | Secure |
| File transfer | ||
| 20/21TCP | FTP File Transfer ProtocolPort 21 carries commands, port 20 the active-mode data channel. Credentials and files travel in cleartext. Use SFTP or FTPS. | Cleartext |
| 989/990TCP | FTPS FTP over TLS (implicit)FTP secured with TLS (implicit mode: 990 control, 989 data). A different protocol from SFTP. | Secure |
| 22TCP | SFTP SSH File Transfer ProtocolFile transfer tunneled inside SSH, so it uses port 22, not an FTP port. | Secure |
| 22TCP | SCP Secure Copy ProtocolFile copy tunneled over SSH. Shares port 22 with SSH and SFTP, so one open port covers all three. | Secure |
| 69UDP | TFTP Trivial File Transfer ProtocolTiny, no authentication, runs over UDP. Used for device configs and PXE boot on trusted networks only. | Cleartext |
| Remote access | ||
| 22TCP | SSH Secure ShellEncrypted remote shell and tunnel. Also carries SFTP and SCP. Replaces Telnet. | Secure |
| 23TCP | Telnet TelnetRemote shell that sends everything, including the password, in cleartext. Replace with SSH. | Cleartext |
| 3389TCP | RDP Remote Desktop ProtocolMicrosoft Remote Desktop. Encrypted, but Internet-exposed RDP is a leading ransomware entry point. Keep it behind a VPN. | Standard |
| 500UDP | IKE Internet Key Exchange (IPsec)Negotiates the keys and security associations for an IPsec VPN. If UDP 500 is blocked, the tunnel never comes up. | Secure |
| 4500UDP | IPsec NAT-T IPsec NAT traversalWraps IKE and ESP in UDP so IPsec works when an endpoint sits behind NAT, which would otherwise break it. | Secure |
| 1194UDP | OpenVPN OpenVPN tunnelTLS-based VPN that does not need IPsec. Runs over UDP by default and can fall back to TCP 443. | Secure |
| 1701UDP | L2TP Layer 2 Tunneling ProtocolTunnels but does not encrypt. Exam answer is L2TP/IPsec, which pairs it with IKE on 500. | Standard |
| 1723TCP | PPTP Point-to-Point Tunneling ProtocolLegacy VPN with broken MS-CHAPv2 authentication. Treat any 1723 listener as a finding. | Cleartext |
| 5900TCP | VNC Virtual Network ComputingCleartext remote desktop with a weak native password scheme. Tunnel it over SSH or replace it with RDP. | Cleartext |
| 5985TCP | WinRM HTTP Windows Remote Management over HTTPRemote PowerShell over cleartext. A favorite lateral movement path once credentials are stolen. | Cleartext |
| 5986TCP | WinRM HTTPS Windows Remote Management over HTTPSThe TLS-protected half of WinRM. This is the one that should be open. | Secure |
| Name and network services | ||
| 53TCP/UDP | DNS Domain Name SystemUDP 53 for normal lookups, TCP 53 for zone transfers and large responses. Classic DNS is unencrypted; secure it with DoH (443) or DoT (853). | Cleartext |
| 853TCP | DoT DNS over TLSEncrypts DNS queries so they cannot be read or tampered with in transit. | Secure |
| 67/68UDP | DHCP Dynamic Host Configuration ProtocolAssigns IP configuration. The server listens on 67, the client on 68. | Standard |
| 123UDP | NTP Network Time ProtocolSynchronizes clocks. Accurate time is critical for logs, Kerberos tickets, and certificate validation. | Standard |
| 179TCP | BGP Border Gateway ProtocolInternet routing between autonomous systems. Hijacked BGP announcements reroute traffic to an attacker. | Standard |
| 546/547UDP | DHCPv6 Dynamic Host Configuration Protocol for IPv6IPv6 addressing. Client listens on 546, server on 547. Rogue DHCPv6 is a common on-path setup. | Standard |
| 1900UDP | SSDP Simple Service Discovery ProtocolUPnP discovery. Reflects and amplifies, so an exposed 1900 turns a host into a DDoS relay. | Cleartext |
| 5353UDP | mDNS Multicast DNSLocal name resolution with no authentication. Answers can be spoofed to redirect a client. | Cleartext |
| 5355UDP | LLMNR Link-Local Multicast Name ResolutionWindows fallback name resolution. Poisoning it harvests NTLM hashes, which is why hardening guides disable it. | Cleartext |
| Directory and authentication | ||
| 389TCP/UDP | LDAP Lightweight Directory Access ProtocolDirectory lookups and authentication in cleartext. Secure version is LDAPS on 636. | Cleartext |
| 636TCP | LDAPS LDAP over TLSLDAP wrapped in SSL/TLS. | Secure |
| 88TCP/UDP | Kerberos Kerberos authenticationTicket-based authentication used by Active Directory. Issues time-limited tickets instead of sending reusable passwords. | Secure |
| 1812/1813UDP | RADIUS Remote Authentication Dial-In User ServiceAAA for network access. 1812 handles authentication, 1813 accounting. Only the password field is encrypted (legacy ports 1645/1646). | Standard |
| 1645/1646UDP | RADIUS legacy Pre-standard RADIUS portsThe original RADIUS ports, still seen on older gear. 1812/1813 are the standard ones to answer with. | Cleartext |
| 49TCP | TACACS+ Terminal Access Controller Access-Control System PlusCisco AAA protocol. Encrypts the entire payload and separates authentication, authorization, and accounting. | Secure |
| 3268/3269TCP | Global Catalog Active Directory global catalogForest-wide LDAP lookups. 3268 is cleartext, 3269 is the TLS version. | Standard |
| Monitoring and logging | ||
| 161/162UDP | SNMP Simple Network Management ProtocolNetwork device monitoring. 161 polls agents, 162 receives traps. v1 and v2c send community strings in cleartext; use SNMPv3 for auth and encryption. | Cleartext |
| 514UDP | Syslog SyslogCleartext log forwarding to a collector or SIEM. Secure it with syslog over TLS on 6514. | Cleartext |
| 6514TCP | Syslog over TLS Secure syslogSyslog carried inside TLS for confidentiality and integrity of log data in transit. | Secure |
| File and database services | ||
| 445TCP | SMB Server Message BlockWindows file and printer sharing, direct-hosted on 445. Never expose it to the Internet; a frequent worm and ransomware vector. | Standard |
| 137-139TCP/UDP | NetBIOS NetBIOS name, datagram, and session servicesLegacy Windows networking (137 name, 138 datagram, 139 session). Superseded by SMB on 445; disable where possible. | Cleartext |
| 1433TCP | MS SQL Server Microsoft SQL ServerDefault listener for Microsoft SQL databases. Keep it behind the firewall, never Internet-facing. | Standard |
| 111TCP/UDP | RPCbind Remote procedure call port mapperTells a caller which port an RPC service listens on. Exposed on Unix hosts it maps the attack surface for free. | Cleartext |
| 135TCP | MSRPC Microsoft RPC endpoint mapperWindows RPC broker. Should never cross a perimeter, and pairs with 445 in most Windows worm traffic. | Cleartext |
| 1521TCP | Oracle DB Oracle database listenerOracle client connections. Like every database port, it belongs on an internal segment only. | Standard |
| 2049TCP | NFS Network File SystemUnix file sharing. Access rests on host trust, so an exported share reachable from a user VLAN is a finding. | Standard |
| 3306TCP | MySQL MySQL and MariaDBThe database port most often found exposed to the internet by a misconfigured cloud security group. | Standard |
| 5432TCP | PostgreSQL PostgreSQL databasePostgreSQL client connections. Same segmentation rule as every other database listener. | Standard |
| Voice and video | ||
| 5060TCP/UDP | SIP Session Initiation ProtocolSets up and tears down voice and video calls in cleartext. Signalling can be read or spoofed. | Cleartext |
| 5061TCP | SIPS SIP over TLSThe encrypted half of SIP signalling. Pair it with SRTP to protect the media stream too. | Secure |
| 1720TCP | H.323 H.323 call signallingOlder VoIP call setup standard. Cleartext, and largely replaced by SIP. | Cleartext |
Test yourself on this sheet
Ten quick questions on the 58 ports and protocols above, or a full run through every one in a random order. Both directions: the port a protocol uses, and the protocol that owns a port. Reading a cheat sheet feels like studying; retrieving it is what makes it stick.
Every answer counts toward your questions practiced and your daily goal on the dashboard.
Study the protocols, not just the numbers
Knowing the port is step one. SecPlus Mastery teaches what each protocol does, when to use its secure version, and drills it with over 1,000 practice questions, timed mock exams, and spaced review across all five SY0-701 domains.
New accounts get 30% off both plans for 7 days: the 90-Day Pass is $27.30 instead of $39.
Security+ ports FAQ
How many ports do I need to know for the Security+ SY0-701 exam?
Focus on the well-known ports for the protocols in the objectives, especially the secure and insecure pairs such as HTTP/HTTPS, FTP/SFTP, Telnet/SSH, and LDAP/LDAPS. This page lists every port you are likely to see, grouped by service.Why does the exam care about secure versus insecure protocols?
Objective 4.5 expects you to swap a cleartext protocol for its encrypted equivalent. Knowing that HTTPS replaces HTTP, SSH replaces Telnet, and LDAPS replaces LDAP, along with the port numbers, is a common question pattern.Is SFTP the same as FTPS?
No. SFTP is file transfer tunneled inside SSH and uses port 22. FTPS is ordinary FTP wrapped in TLS and uses ports 989 and 990 for implicit mode. They are different protocols that solve the same problem.Do I have to memorize whether a protocol uses TCP or UDP?
Yes for the common ones. DNS, DHCP, TFTP, SNMP, NTP, and syslog are the UDP services you are most likely to be tested on, while most session-based protocols such as HTTP, SSH, and SMTP use TCP.
Keep studying: free practice questions, TCP vs UDP, mnemonics and memory tricks, and the Security+ acronyms glossary.
Port assignments follow the well-known port registrations referenced by the CompTIA Security+ SY0-701 objectives. CompTIA and Security+ are trademarks of CompTIA, used here for identification only.