Port Numbers to Know for the A+, Network+, and Security+ Exams

Port numbers are one of the few things on a CompTIA exam that reward flat memorization. There is no reasoning your way to the fact that LDAP is 389. You either know it or you lose the point — and ports show up on the A+, Network+, and Security+ exams, sometimes several times each.

The good news is that the list is short and there is a structure hiding inside it.

Learn the insecure and secure pairs together. Most of the list is one protocol appearing twice — once in the clear, once wrapped in TLS.

The Ports You Must Know

Port	Protocol	TCP/UDP	What it does
20, 21	FTP	TCP	File transfer — 20 is data, 21 is control. Unencrypted.
22	SSH, SCP, SFTP	TCP	Encrypted remote administration and file transfer.
23	Telnet	TCP	Remote administration in cleartext. Legacy; know it as the insecure counterpart to SSH.
25	SMTP	TCP	Sending mail between servers.
49	TACACS+	TCP	AAA service, Cisco-oriented. Encrypts the entire payload.
53	DNS	UDP and TCP	Name resolution. UDP for queries, TCP for zone transfers and large responses.
67, 68	DHCP	UDP	Automatic IP addressing — 67 server, 68 client.
69	TFTP	UDP	Trivial file transfer, no authentication. Common for network device configs.
80	HTTP	TCP	Web traffic, unencrypted.
88	Kerberos	TCP and UDP	Authentication in Active Directory environments.
110	POP3	TCP	Retrieving mail, typically downloading and removing it from the server.
123	NTP	UDP	Time synchronization. Matters more than it sounds — Kerberos breaks when clocks drift.
137, 138, 139	NetBIOS	TCP and UDP	Legacy Windows name service and session support.
143	IMAP	TCP	Retrieving mail while leaving it synchronized on the server.
161, 162	SNMP	UDP	Network device monitoring — 161 for queries, 162 for traps.
389	LDAP	TCP and UDP	Directory services lookups, unencrypted.
443	HTTPS	TCP	Web traffic over TLS.
445	SMB/CIFS	TCP	Windows file and printer sharing. Heavily targeted; should never be exposed to the internet.
465, 587	SMTP secure / submission	TCP	Encrypted mail submission. 587 with STARTTLS is the modern default.
500	ISAKMP / IKE	UDP	Key exchange for IPsec VPNs.
514	Syslog	UDP	Centralized log collection.
636	LDAPS	TCP	LDAP over TLS.
993	IMAPS	TCP	IMAP over TLS.
995	POP3S	TCP	POP3 over TLS.
1433	Microsoft SQL Server	TCP	Database traffic.
1521	Oracle	TCP	Database traffic.
1812, 1813	RADIUS	UDP	AAA — 1812 authentication, 1813 accounting. Encrypts only the password.
3306	MySQL	TCP	Database traffic.
3389	RDP	TCP	Remote Desktop. Along with 22 and 445, one of the most attacked ports on the internet.
5060, 5061	SIP	TCP and UDP	Voice over IP session setup — 5061 is the TLS version.
5432	PostgreSQL	TCP	Database traffic.
5900	VNC	TCP	Cross-platform remote desktop.
8080	HTTP alternate	TCP	Proxies, web admin consoles, and development servers.

Learn Them in Pairs

This is the single most useful trick for this material. A large share of the list is the same protocol twice, and exam questions love asking you to swap an insecure service for its secure equivalent.

• HTTP 80 → HTTPS 443
• FTP 21 → FTPS 990, or better, SFTP over SSH 22
• Telnet 23 → SSH 22
• LDAP 389 → LDAPS 636
• IMAP 143 → IMAPS 993
• POP3 110 → POP3S 995
• SMTP 25 → SMTP with STARTTLS 587
• SIP 5060 → SIP-TLS 5061

Notice how often the secure version is simply a higher number in the 600–1000 range. That pattern will not carry you through every question, but it is a useful sanity check when two answers look plausible.

Port Ranges

Exams ask about the ranges themselves, not just individual ports.

• 0–1023: well-known ports. Assigned by IANA to standard services. On Unix-like systems, binding to these requires elevated privilege.
• 1024–49151: registered ports. Assigned to specific vendor applications — 1433, 3306, 3389 and similar live here.
• 49152–65535: dynamic, private, or ephemeral ports. Assigned temporarily to the client side of a connection. This is the range that matters when you write stateless firewall rules, because return traffic arrives on it.

TCP or UDP?

Most services are TCP, so it is more efficient to memorize the UDP exceptions: DHCP (67/68), TFTP (69), SNMP (161/162), NTP (123), Syslog (514), and IKE (500). DNS and Kerberos use both. Everything else on the list above is TCP, and the pattern holds well enough to guess from.

How to Actually Memorize These

• Drill the pairs, not the individual numbers. Half the list comes free once the pairs are solid.
• Group by function — mail (25, 110, 143, 465, 587, 993, 995), directory and authentication (49, 88, 389, 636, 1812), remote access (22, 23, 3389, 5900), databases (1433, 1521, 3306, 5432).
• Use spaced repetition. Fifteen minutes of flashcards daily beats a three-hour cram session, and this is exactly the kind of material spacing was designed for.
• Type them in. Run netstat -an on your own machine and match what you see against the table. Recognition in context sticks far better than a list.

Exam Tips

A+ (220-1201/1202). The core set only: 20/21, 22, 23, 25, 53, 67/68, 80, 110, 143, 443, 445, 3389. Expect straight recall and a few "which port does this service use" items.

Network+ (N10-009). The full table, plus the port ranges, plus TCP versus UDP. Expect troubleshooting scenarios where a blocked port is the cause — a user cannot reach a secure website, a mail client cannot retrieve messages, a device is not getting an address. Work backward from the symptom to the port.

Security+ (SY0-701). Ports appear as a security matter. Know which are dangerous when exposed (23, 445, 3389, 21), which secure alternative to recommend, and how port scanning and firewall rules use them. A question describing an unnecessary open port is asking about attack surface.

Key Takeaways

• Ports are pure recall. There is no shortcut, but the list is short enough to own in a week.
• Learn the insecure-to-secure pairs together — it halves the work and matches how exams ask.
• Know the three ranges: well-known 0–1023, registered 1024–49151, ephemeral 49152–65535.
• Memorize the UDP exceptions rather than the TCP majority.
• 23, 445, 3389 and 21 are the ones that get organizations breached when exposed to the internet.