21 Ports, Protocols & Services Practice Questions & Answers

Every Ports, Protocols & Services practice question from the CompTIA Network+ Practice Test, with the correct answer and a short explanation.

Start practice test →

1. A firewall change request asks you to permit directory service lookups that are protected with TLS between an application server and a domain controller. Which destination port must the rule allow?
- A.TCP 443
- B.TCP 636✓ Answer
- C.TCP 989
- D.TCP 389
LDAP secured with TLS (LDAPS) is registered on TCP 636, while unprotected LDAP runs on TCP 389. A firewall filters on the destination port, so opening only 389 would force the directory lookup back to cleartext; TCP 443 carries HTTPS and TCP 989 is the FTPS data channel.
Source: IANA Service Name and Transport Protocol Port Number Registry (ldap 389, ldaps 636)Report a problem with this question
2. An administrator must copy configuration files to a server over an encrypted channel and wants the transfer to reuse the same service and port already open for command-line administration. Which protocol and port meet this requirement?
- A.FTP over TCP 21
- B.FTPS over TCP 990
- C.TFTP over UDP 69
- D.SFTP over TCP 22✓ Answer
SFTP is a file transfer subsystem carried inside an SSH session, so it uses the SSH port TCP 22 that is already open for remote administration. FTPS is FTP wrapped in TLS and uses its own control port, TFTP is an unauthenticated UDP protocol on port 69, and FTP on TCP 21 sends credentials in cleartext.
Source: RFC 4253 (SSH Transport Layer Protocol) and IANA Service Name and Transport Protocol Port Number Registry (ssh 22)Report a problem with this question
3. Network devices are configured to forward event messages to a central log collector, but nothing arrives. Which listener does the collector need for standard syslog forwarding?
- A.UDP 162
- B.UDP 514✓ Answer
- C.TCP 22
- D.TCP 514
Syslog is registered as a UDP service on port 514, which is why log delivery is best effort and unacknowledged. TCP port 514 is registered to the older remote shell service, UDP 162 receives SNMP traps, and TCP 22 is SSH.
Source: RFC 5426 (Transmission of Syslog Messages over UDP) and IANA Service Name and Transport Protocol Port Number Registry (syslog 514/udp)Report a problem with this question
4. A mail client must authenticate to the organization's mail server and hand off outgoing messages, upgrading the session to TLS with STARTTLS. Which port is designated for authenticated message submission?
- A.TCP 25
- B.TCP 587✓ Answer
- C.TCP 110
- D.TCP 143
Port 587 is the message submission port, where a client authenticates and the server applies submission policy; TCP 25 is reserved for server-to-server relay of mail and is commonly blocked outbound for clients. TCP 110 is POP3 and TCP 143 is IMAP, which retrieve mail rather than send it.
Source: RFC 6409 (Message Submission for Mail) and RFC 5321 (Simple Mail Transfer Protocol)Report a problem with this question
5. A packet capture on the management VLAN shows administrator usernames and passwords in readable text inside sessions destined for TCP 23. Which change actually fixes the exposure?
- A.Move the Telnet service to a nonstandard port such as TCP 2323
- B.Tunnel the Telnet session inside HTTP on TCP 80
- C.Replace Telnet with SSH on TCP 22✓ Answer
- D.Replace Telnet with TFTP on UDP 69
Telnet on TCP 23 carries the entire session, including credentials, without encryption, so the only real fix is a protocol that encrypts and authenticates the channel: SSH on TCP 22. Changing the port number only hides the service from casual scans while the traffic remains readable, and TFTP or plain HTTP add no confidentiality.
Source: RFC 854 (Telnet Protocol Specification) and RFC 4251 (SSH Protocol Architecture)Report a problem with this question
6. Users read mail from both a laptop and a phone and complain that folder structure and read/unread status do not match between the two devices. Which retrieval protocol should the mailbox use?
- A.SMTP on TCP 25
- B.POP3 on TCP 110
- C.IMAP on TCP 143✓ Answer
- D.SNMP on UDP 161
IMAP keeps the authoritative copy of the mailbox on the server and synchronizes folders and message flags to every client, so all devices see the same state. POP3 is designed to download messages to one client and by default removes them from the server, and SMTP only sends mail while SNMP is a management protocol.
Source: RFC 3501 (Internet Message Access Protocol) and RFC 1939 (Post Office Protocol - Version 3)Report a problem with this question
7. Which sequence of segments correctly describes how a TCP connection is established before any application data is sent?
- A.SYN, SYN-ACK, ACK✓ Answer
- B.ACK, SYN, SYN-ACK
- C.SYN, FIN, ACK
- D.SYN, ACK, SYN-ACK
The three-way handshake exists so both ends exchange and acknowledge initial sequence numbers: the client sends SYN with its ISN, the server answers SYN-ACK carrying its own ISN and acknowledging the client's, and the client sends the final ACK. FIN belongs to connection teardown, not setup.
Source: RFC 9293 (Transmission Control Protocol)Report a problem with this question
8. During a large file transfer the receiving host's buffer starts to fill faster than the application can read from it. Which TCP mechanism lets the receiver slow the sender down without tearing down the connection?
- A.Reducing the advertised receive window✓ Answer
- B.Sending ICMP echo requests back to the sender
- C.Lowering the TTL value in the IP header
- D.Changing the DSCP marking on the flow
TCP flow control works through the window field in the header: the receiver advertises how much buffer space remains, and the sender may have no more than that amount of unacknowledged data outstanding. TTL governs how many router hops a packet survives, ICMP echo is a reachability test, and DSCP is a QoS marking, none of which regulate the sender's rate on a given TCP session.
Source: RFC 9293 (Transmission Control Protocol) - receive window and flow controlReport a problem with this question
9. A design team must choose a transport for real-time voice traffic in which a retransmitted packet would arrive too late to be played out. Which choice is appropriate, and why?
- A.UDP, because it is connectionless and neither waits for acknowledgements nor retransmits lost packets✓ Answer
- B.TCP, because sequence numbers guarantee that every sample is delivered
- C.TCP, because its header is smaller than the UDP header
- D.UDP, because it encrypts the media stream by default
UDP is connectionless with an 8-byte header and no handshake, acknowledgements, or retransmission, so it adds the least delay and jitter, which is what interactive voice needs. TCP's minimum header is 20 bytes and its guaranteed delivery would stall the stream waiting for a retransmission of audio that is already obsolete; UDP itself provides no encryption.
Source: RFC 768 (User Datagram Protocol) and RFC 9293 (Transmission Control Protocol)Report a problem with this question
10. A secondary DNS server cannot pull a zone from the primary, even though ordinary name lookups through the same firewall succeed. The access list permits UDP 53 only. What must be added?
- A.TCP 853
- B.UDP 69
- C.UDP 123
- D.TCP 53✓ Answer
DNS uses UDP 53 for ordinary queries but switches to TCP 53 for zone transfers and for any response too large to fit in a single datagram, because a zone transfer is a reliable, potentially long stream of records. UDP 69 is TFTP, TCP 853 is DNS over TLS, and UDP 123 is NTP.
Source: RFC 1035 (Domain Names - Implementation and Specification) and RFC 5966 (DNS Transport over TCP)Report a problem with this question
11. Client software must automatically discover which host and which port provide a particular service in a domain, without either value being configured by hand. Which DNS record type carries that information?
- A.MX
- B.PTR
- C.TXT
- D.SRV✓ Answer
An SRV record names the service and transport protocol and returns the target host together with the port number, plus priority and weight for selection among several servers. MX returns only mail exchanger hostnames with no port, PTR maps an address back to a name for reverse lookups, and TXT holds arbitrary text such as policy strings.
Source: RFC 2782 (A DNS RR for specifying the location of services)Report a problem with this question
12. A security team finds that workstation name resolution is being answered by an outside resolver, and on the wire the traffic is indistinguishable from ordinary encrypted web browsing. Which mechanism explains this?
- A.A zone transfer running on TCP 853
- B.DNS over TCP 53 using compressed responses
- C.DNS over HTTPS, which carries queries inside TLS on TCP 443✓ Answer
- D.DNSSEC, which encrypts the contents of every query
DNS over HTTPS encapsulates queries in HTTPS on TCP 443, so they blend into the same flows as web traffic and cannot be separated by port, which is why it bypasses port-53 based filtering and internal resolvers. DNSSEC signs records to prove authenticity but leaves them readable, and TCP 853 is the port for DNS over TLS, which is distinguishable by its own port.
Source: RFC 8484 (DNS Queries over HTTPS) and RFC 4033 (DNS Security Introduction and Requirements)Report a problem with this question
13. A workstation with no IPv4 address boots and sends a DHCPDISCOVER. Which source and destination ports does that broadcast use?
- A.Source TCP 68, destination TCP 67
- B.Source UDP 67, destination UDP 68
- C.Source UDP 546, destination UDP 547
- D.Source UDP 68, destination UDP 67✓ Answer
DHCP runs over UDP because the client has no address yet and cannot complete a TCP handshake; the client port is 68 and the server port is 67, so a DISCOVER leaves the client from 68 and is broadcast to 67. The reversed pair describes the server's reply direction, and UDP 546 and 547 are the DHCPv6 client and server ports.
Source: RFC 2131 (Dynamic Host Configuration Protocol) and IANA Service Name and Transport Protocol Port Number Registry (bootps 67, bootpc 68)Report a problem with this question
14. Hosts on a remote VLAN self-assign addresses in the 169.254.0.0/16 range, while hosts on the same subnet as the DHCP server lease normally. Which configuration resolves this?
- A.Enable broadcast forwarding on each client
- B.Add a static route from the clients to the DHCP server
- C.Shorten the lease time configured in the scope
- D.Configure a DHCP relay agent (IP helper) on the remote VLAN's gateway interface✓ Answer
A DHCPDISCOVER is a broadcast, and routers do not forward broadcasts between subnets, so clients on a remote VLAN never reach the server and fall back to a link-local 169.254 address. A relay agent on the router interface receives the broadcast and forwards it as unicast to the configured server, then returns the reply. A static route does not help because the client has no usable address to route with.
Source: RFC 2131 (Dynamic Host Configuration Protocol) - relay agent behavior; RFC 3927 (Dynamic Configuration of IPv4 Link-Local Addresses)Report a problem with this question
15. A label printer must always receive the same IPv4 address, but the technician does not want to configure the device by hand and wants the address to stay under DHCP management within the existing scope. What should be created?
- A.A separate scope that contains only that one address
- B.An exclusion range that removes the address from the pool
- C.A DHCP reservation that binds the address to the device's MAC address✓ Answer
- D.A shorter lease time for the whole scope
A reservation maps a specific address to a client's hardware (MAC) address inside the scope, so the device keeps using DHCP and still receives options such as gateway and DNS while always getting the same lease. An exclusion does the opposite: it withholds the address from the pool so it can only be assigned statically on the device itself.
Source: RFC 2131 (Dynamic Host Configuration Protocol) - client identifier and static bindingsReport a problem with this question
16. In an NTP hierarchy, how is a stratum 1 time server best described?
- A.A client that takes its time from another client
- B.A server directly attached to an authoritative reference clock✓ Answer
- C.A server that has not synchronized with any source
- D.A server that distributes time using TCP 123
Stratum counts distance from the reference clock: the reference clock itself is stratum 0, a server directly attached to it is stratum 1, and each server that synchronizes from another adds one level, with stratum 16 meaning unsynchronized. NTP is carried over UDP 123, not TCP, and accurate time matters because log correlation and time-sensitive authentication both fail when clocks drift apart.
Source: RFC 5905 (Network Time Protocol Version 4: Protocol and Algorithms Specification)Report a problem with this question
17. A monitoring platform must receive unsolicited alerts that managed devices generate the instant an interface fails, rather than waiting for the next scheduled poll. Which port must the manager be listening on?
- A.UDP 161
- B.TCP 161
- C.UDP 514
- D.UDP 162✓ Answer
In SNMP the manager polls agents by sending get requests to UDP 161, but agent-initiated messages (traps and notifications) travel in the opposite direction to UDP 162 on the manager, which is what makes event-driven alerting possible. UDP 514 is syslog, a different logging mechanism.
Source: IANA Service Name and Transport Protocol Port Number Registry (snmp 161, snmptrap 162) and RFC 3411 (SNMP Management Frameworks)Report a problem with this question
18. A network requires that management queries be authenticated and that the values returned from the MIB be encrypted while in transit. Which structural characteristic identifies the version of SNMP that satisfies this?
- A.It requires MIB files to be compiled on the agent
- B.It hashes the community string in the first packet only
- C.It moves all management traffic to TCP 161
- D.It replaces community strings with per-user authentication and encrypts the message payload✓ Answer
The version built on the user-based security model adds authentication of each message to a named user and privacy (encryption) of the payload, which is exactly what the requirement asks for. The community-string versions send that string in cleartext as the only credential, so anyone capturing traffic can read it and the returned values.
Source: RFC 3414 (User-based Security Model for SNMPv3)Report a problem with this question
19. A site-to-site IPsec tunnel must keep the payload confidential as it crosses the internet. Which statement correctly separates what the two IPsec security protocols provide?
- A.AH provides the encryption, while ESP only authenticates the sender
- B.ESP provides encryption plus integrity, while AH provides integrity and origin authentication with no confidentiality✓ Answer
- C.Both AH and ESP encrypt the payload, but only AH authenticates it
- D.IKE encrypts the payload, and ESP negotiates the keys
The Encapsulating Security Payload encrypts the protected data and can also verify its integrity, which is why it is used whenever confidentiality is required. The Authentication Header provides connectionless integrity and data-origin authentication only, and because it authenticates immutable IP header fields it breaks when a device rewrites addresses for NAT. IKE negotiates the security associations and keys rather than protecting the data itself.
Source: RFC 4303 (IP Encapsulating Security Payload) and RFC 4302 (IP Authentication Header)Report a problem with this question
20. An engineer builds a tunnel that must carry a dynamic routing protocol and multicast between two sites, then protects that tunnel with IPsec. Which statement about the identifiers involved is correct?
- A.GRE listens on TCP port 47 and encrypts the tunnel by itself
- B.GRE and ESP are both TCP port numbers assigned by IANA
- C.GRE is IP protocol number 47 and only encapsulates, while IKE negotiates the IPsec security associations over UDP 500✓ Answer
- D.GRE is IP protocol number 50, and IKE uses UDP 4500 exclusively
GRE is identified by protocol number 47 in the IP header's protocol field, not by a TCP or UDP port, and it only encapsulates: it adds no confidentiality, which is why it is paired with IPsec when traffic such as routing updates and multicast must be both tunnelled and protected. ESP and AH are likewise protocol numbers 50 and 51, while IKE runs on UDP 500 with UDP 4500 used when NAT traversal is needed.
Source: RFC 2784 (Generic Routing Encapsulation), IANA Protocol Numbers registry (GRE 47, ESP 50, AH 51), RFC 7296 (Internet Key Exchange Protocol)Report a problem with this question
21. Voice traffic must be given priority both inside a Layer 2 trunk between switches and across every routed hop. Which pair of markings does the network use to signal that priority?
- A.Source MAC priority at Layer 2 and source port priority at Layer 3
- B.DSCP carried in the Ethernet frame header and CoS carried in the TCP header
- C.TTL at Layer 2 and MTU size at Layer 3
- D.CoS bits carried in the 802.1Q tag at Layer 2 and DSCP bits in the IP header at Layer 3✓ Answer
Class of Service is a three-bit priority field inside the 802.1Q VLAN tag, so it exists only on tagged Layer 2 links and is lost the moment the frame is untagged or routed. DSCP is a six-bit field in the IP header's differentiated services byte, so it survives every routed hop, which is why classification is normally marked at both layers. TTL and MTU are not priority mechanisms.
Source: IEEE 802.1Q (priority code point) and RFC 2474 (Definition of the Differentiated Services Field)Report a problem with this question

Practice questions based on the CompTIA Network+ exam domains and the published standards the exam is built on (IEEE 802.3 and 802.11, IEEE 802.1Q and 802.1X, the IANA port registry, IETF RFCs, and TIA-568 cabling). CompTIA and Network+ are marks of CompTIA; this site is not affiliated with or endorsed by CompTIA. Exam objectives are revised periodically — check the current official objectives for your exam version before testing. About the Network+ exam →

1. A firewall change request asks you to permit directory service lookups that are protected with TLS between an application server and a domain controller. Which destination port must the rule allow?

2. An administrator must copy configuration files to a server over an encrypted channel and wants the transfer to reuse the same service and port already open for command-line administration. Which protocol and port meet this requirement?

3. Network devices are configured to forward event messages to a central log collector, but nothing arrives. Which listener does the collector need for standard syslog forwarding?

4. A mail client must authenticate to the organization's mail server and hand off outgoing messages, upgrading the session to TLS with STARTTLS. Which port is designated for authenticated message submission?

5. A packet capture on the management VLAN shows administrator usernames and passwords in readable text inside sessions destined for TCP 23. Which change actually fixes the exposure?

6. Users read mail from both a laptop and a phone and complain that folder structure and read/unread status do not match between the two devices. Which retrieval protocol should the mailbox use?

7. Which sequence of segments correctly describes how a TCP connection is established before any application data is sent?

8. During a large file transfer the receiving host's buffer starts to fill faster than the application can read from it. Which TCP mechanism lets the receiver slow the sender down without tearing down the connection?

9. A design team must choose a transport for real-time voice traffic in which a retransmitted packet would arrive too late to be played out. Which choice is appropriate, and why?

10. A secondary DNS server cannot pull a zone from the primary, even though ordinary name lookups through the same firewall succeed. The access list permits UDP 53 only. What must be added?

11. Client software must automatically discover which host and which port provide a particular service in a domain, without either value being configured by hand. Which DNS record type carries that information?

12. A security team finds that workstation name resolution is being answered by an outside resolver, and on the wire the traffic is indistinguishable from ordinary encrypted web browsing. Which mechanism explains this?

13. A workstation with no IPv4 address boots and sends a DHCPDISCOVER. Which source and destination ports does that broadcast use?

14. Hosts on a remote VLAN self-assign addresses in the 169.254.0.0/16 range, while hosts on the same subnet as the DHCP server lease normally. Which configuration resolves this?

15. A label printer must always receive the same IPv4 address, but the technician does not want to configure the device by hand and wants the address to stay under DHCP management within the existing scope. What should be created?

16. In an NTP hierarchy, how is a stratum 1 time server best described?

17. A monitoring platform must receive unsolicited alerts that managed devices generate the instant an interface fails, rather than waiting for the next scheduled poll. Which port must the manager be listening on?

18. A network requires that management queries be authenticated and that the values returned from the MIB be encrypted while in transit. Which structural characteristic identifies the version of SNMP that satisfies this?

19. A site-to-site IPsec tunnel must keep the payload confidential as it crosses the internet. Which statement correctly separates what the two IPsec security protocols provide?

20. An engineer builds a tunnel that must carry a dynamic routing protocol and multicast between two sites, then protects that tunnel with IPsec. Which statement about the identifiers involved is correct?

21. Voice traffic must be given priority both inside a Layer 2 trunk between switches and across every routed hop. Which pair of markings does the network use to signal that priority?