Security+ Ports and Protocols Cheat Sheet: Secure vs Insecure Pairs
Reach 50,000+ security professionals
Sponsor a newsletter slot and put your brand in front of CISOs, engineers, and IT decision-makers.
A short list of ports and protocols answers a surprising number of Security+ questions, especially ones that describe traffic, a firewall rule or an attack. This cheat sheet gives the core ports to memorize, marks which protocols are encrypted, pairs each insecure protocol with its secure replacement, and adds memory tips. The port numbers follow the IANA registry and common practice. These are our own study summaries of standard facts, not CompTIA's lists. The official CompTIA objectives document remains the authority for what is tested.
How to Use This Cheat Sheet
Questions that describe traffic, firewall rules or an attack often hinge on knowing which port and protocol are involved, and whether they are encrypted. These are our own study summaries of standard facts, not CompTIA's lists. The official CompTIA objectives document remains the authority for what is tested. Memorize the first table, skim the second, and drill the insecure to secure pairs until they are automatic.
Core Ports and Protocols to Memorize
| Port | Protocol | Transport | Secure or insecure | Notes |
|---|---|---|---|---|
| 20, 21 | FTP | TCP | Insecure | 21 is the control channel, 20 is data in active mode. Credentials and data travel in clear text |
| 22 | SSH, SCP, SFTP | TCP | Secure | Encrypted remote shell and file transfer over one port. SFTP runs over SSH and is not the same as FTPS |
| 23 | Telnet | TCP | Insecure | Clear-text remote shell. Replace with SSH |
| 25 | SMTP | TCP | Insecure by default | Server-to-server mail relay |
| 53 | DNS | UDP and TCP | Insecure by default | UDP for most queries, TCP for large responses and zone transfers |
| 67, 68 | DHCP | UDP | Insecure | 67 is the server, 68 is the client |
| 69 | TFTP | UDP | Insecure | No authentication, used for network device boot and config files |
| 80 | HTTP | TCP | Insecure | Web traffic in clear text |
| 88 | Kerberos | TCP and UDP | Secure ticket-based auth | Active Directory authentication |
| 110 | POP3 | TCP | Insecure | Mail retrieval in clear text |
| 123 | NTP | UDP | Insecure by default | Time synchronization |
| 143 | IMAP | TCP | Insecure | Mail access in clear text |
| 161, 162 | SNMP | UDP | SNMPv3 is secure | 161 for queries, 162 for traps. Versions 1 and 2c use clear-text community strings |
| 389 | LDAP | TCP and UDP | Insecure | Directory queries in clear text |
| 443 | HTTPS | TCP | Secure | HTTP over TLS. QUIC and HTTP/3 also use UDP 443 |
| 445 | SMB | TCP | Depends on version and signing | Windows file sharing. Do not expose to the internet |
| 514 | Syslog | UDP | Insecure | Log forwarding in clear text |
| 636 | LDAPS | TCP | Secure | LDAP over TLS |
| 993 | IMAPS | TCP | Secure | IMAP over TLS |
| 995 | POP3S | TCP | Secure | POP3 over TLS |
| 1433 | Microsoft SQL Server | TCP | Depends on config | Database access |
| 1521 | Oracle database listener | TCP | Depends on config | Database access |
| 3306 | MySQL | TCP | Depends on config | Database access |
| 3389 | RDP | TCP and UDP | Encrypted, but a frequent attack target | Remote Desktop. Do not expose directly to the internet |
| 5432 | PostgreSQL | TCP | Depends on config | Database access |
Briefings like this, every morning before 9am.
Threat intel, active CVEs, and campaign alerts, distilled for practitioners. 50,000+ subscribers. No noise.
Additional Ports You May See
| Port | Protocol | Transport | Notes |
|---|---|---|---|
| 49 | TACACS+ | TCP | AAA for network devices, encrypts the whole payload |
| 137, 138, 139 | NetBIOS | UDP and TCP | Legacy Windows name and session services |
| 465 | SMTPS | TCP | SMTP over implicit TLS for mail submission |
| 500 | IKE (IPsec key exchange) | UDP | Negotiates IPsec security associations |
| 587 | SMTP submission | TCP | Mail submission from clients, usually with STARTTLS |
| 853 | DNS over TLS | TCP | Encrypted DNS |
| 990 | FTPS (implicit) | TCP | FTP over TLS. Explicit FTPS uses port 21 with STARTTLS |
| 1194 | OpenVPN | UDP by default | TCP also supported |
| 1701 | L2TP | UDP | Often paired with IPsec |
| 1723 | PPTP | TCP | Obsolete and insecure VPN protocol |
| 1812, 1813 | RADIUS | UDP | 1812 for authentication, 1813 for accounting |
| 4500 | IPsec NAT traversal | UDP | Used when IPsec passes through NAT |
| 5060, 5061 | SIP | TCP and UDP | 5060 is unencrypted, 5061 is SIP over TLS |
| 5900 | VNC | TCP | Remote desktop, weak by default |
| 5985, 5986 | WinRM | TCP | 5985 is HTTP, 5986 is HTTPS |
| 6514 | Syslog over TLS | TCP | Encrypted log forwarding |
| 51820 | WireGuard | UDP | Default port, can be changed |
Insecure Protocols and Their Secure Replacements
A common question pattern asks which protocol to replace or which port to open for the secure version.
| Insecure | Secure replacement |
|---|---|
| Telnet (23) | SSH (22) |
| FTP (21) | SFTP (22) or FTPS (990 or 21 with STARTTLS) |
| HTTP (80) | HTTPS (443) |
| POP3 (110) | POP3S (995) |
| IMAP (143) | IMAPS (993) |
| LDAP (389) | LDAPS (636) |
| SNMPv1 and v2c (161) | SNMPv3 |
| Syslog (514 UDP) | Syslog over TLS (6514) |
| SMTP without encryption (25) | SMTP submission with TLS (587 or 465) |
| DNS (53) | DNS over TLS (853) or DNS over HTTPS (443) |
Memory Tips
A few patterns make the list easier to hold.
Secure versions usually add an S or move to a new port
HTTPS, LDAPS, IMAPS and POP3S are the TLS versions of HTTP, LDAP, IMAP and POP3. The clear-text ports are 80, 389, 143 and 110, and the secure ones are 443, 636, 993 and 995.
Pair the ports that come in twos
FTP is 20 and 21, DHCP is 67 and 68, SNMP is 161 and 162, RADIUS is 1812 and 1813, and SIP is 5060 and 5061.
Know which protocols use UDP
DNS (mostly), DHCP, TFTP, NTP, SNMP, syslog and RADIUS are the common UDP services. Most others use TCP.
Learn the attack-prone ones
RDP (3389), SMB (445), Telnet (23) and exposed database ports are frequent targets, so questions about hardening often involve closing or restricting them.
Where This Fits in Your Study
Ports and protocols appear in networking and security questions across the exam. See our Security+ objectives explained for the domains these touch, the Network+ guide if you want the networking depth, and our study plan for how to schedule the memorization. DD Academy turns facts like these into flashcards with spaced review. It is free to start on iPhone and the web.
The bottom line
Memorize the core table, know the insecure to secure pairs and remember which services use UDP. Then practice with scenario questions that describe traffic or rules, so you can identify the protocol from a port and the fix from a protocol.
Frequently asked questions
What ports do I need to know for Security+?
Know the common ones: FTP 20 and 21, SSH 22, Telnet 23, SMTP 25, DNS 53, DHCP 67 and 68, HTTP 80, POP3 110, IMAP 143, SNMP 161 and 162, LDAP 389, HTTPS 443, SMB 445, LDAPS 636, IMAPS 993, POP3S 995 and RDP 3389. The tables above add the rest you may see.
What is the difference between FTPS and SFTP?
FTPS is FTP wrapped in TLS, using port 990 for implicit mode or port 21 with STARTTLS for explicit mode. SFTP is a separate protocol that runs over SSH on port 22. They are not interchangeable.
Which ports use UDP?
The common UDP services are DNS for most queries (53), DHCP (67 and 68), TFTP (69), NTP (123), SNMP (161 and 162), syslog (514) and RADIUS (1812 and 1813). DNS also uses TCP for large responses and zone transfers.
What is the secure version of LDAP?
LDAPS, which is LDAP over TLS, uses port 636. Standard LDAP on port 389 sends data in clear text unless it is protected another way.
Why is port 3389 a security concern?
3389 is Remote Desktop Protocol. It is a frequent target for brute-force and exploitation attempts when exposed to the internet, so it should be restricted, placed behind a VPN or gateway, and protected with multifactor authentication.
Are port numbers actually tested on Security+?
CompTIA does not publish a ports list in the Security+ materials we checked, but questions regularly describe protocols, firewall rules and traffic in ways that are easier if you know the common ports. Network+ lists ports more directly in its objectives.
Where do official port assignments come from?
The Internet Assigned Numbers Authority (IANA) maintains the registry of service names and port numbers. Some commonly used ports, such as SMTP submission on 587, are registered there, while others are conventions that vary by product.
Sources & references
Free resources
Critical CVE Reference Card 2025–2026
25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.
Ransomware Incident Response Playbook
Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.
Daily briefings + Google Top Stories in one step.
Enter your email and we'll subscribe you to the daily briefing and add Decryption Digest to your Google Search feed at the same time.
Founder & Cybersecurity Evangelist, Decryption Digest
Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals every morning.
