ExamFinch.com My Study

Study guide

High-Yield Ports and Protocols Table

Practice this exam

CompTIA Network+ N10-009

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

Current Exam Facts and Applied Networking Judgment Official Domain Weights and an 8-12 Week Study Plan How to Use Labs, Practice, and PBQ Workflow Missed-Question Notebook and Final Readiness Metrics

2 Domain 1: Networking Concepts (23%)

OSI and TCP/IP Models with Device and Protocol Mapping Networking Appliances and Where They Operate Ports and Protocol Decision Table Traffic Types and Encapsulation Flow

3 Domain 1: Media, Connectors, Transceivers, and Network Architectures

Copper, Fiber, Coax, and DAC Media Connector and Transceiver Selection Network Topologies and Design Patterns Cloud and Virtual Networking Concepts

4 Domain 1: IP Addressing and Subnetting Mastery

IPv4 Classes, Private/Public, APIPA, and Loopback CIDR, VLSM, and Subnet Math IPv6 Address Types and Notation Routing Basics and Longest Prefix Match

5 Domain 2: Network Implementation - Routing

Static vs Dynamic Routing and Route Selection OSPF, EIGRP, and BGP Basics at Network+ Depth NAT/PAT, VIP/FHRP, and Subinterfaces Routing PBQs and Troubleshooting Route Table Clues

6 Domain 2: Network Implementation - Switching

VLANs, Access Ports, Trunks, and Native VLAN STP/RSTP Loop Prevention and Bridge Roles Port Aggregation/LACP, MTU, Jumbo Frames, and Interface Settings Switch Implementation PBQs and Common Misconfigurations

7 Domain 2: Network Implementation - Wireless and Physical Implementation

Wi-Fi Standards, Bands, and Channels SSID Security, Guest Networks, and Authentication Antennas, Coverage, Roaming, Interference, and Site Surveys Physical Installation Implications

8 Domain 2: Network Implementation - Services Implementation

DNS Record Types and Troubleshooting Cues DHCP, DHCPv6, SLAAC, Scopes, Leases, and Relay NTP, PTP, NTS, and Time-Sensitive Networking Service Implementation PBQs: DNS, DHCP, VLANs, and Firewall Direction

9 Domain 3 Part A: Network Operations Documentation and Governance

Physical, Logical, Rack, Cable, Wireless Diagrams, and IPAM Asset Inventory, Baselines, SLAs, SOPs, and Runbooks Change Management and Request Tracking Lifecycle, EOL, EOS, Decommissioning, and Configuration Management

10 Domain 3 Part B: Monitoring, Remote Access, and Resilience

SNMP, Flow, Syslog, Packet Capture, Log Aggregation, APIs, and Port Mirroring Baselines and Performance Metrics Remote Access, Management Paths, and Secure Admin Habits DR and HA Concepts: RPO, RTO, MTTR, MTBF, Sites, Failover, and Testing

11 Domain 4: Logical Security and Secure Access (14%)

Encryption in Transit, Encryption at Rest, PKI, and Certificates IAM, MFA, SSO, Directory Services, and AAA Authorization, Least Privilege, RBAC, Geofencing, and Time-Based Access VPNs and Secure Management Design

12 Domain 4: Segmentation, Risk, and Network Attacks (14%)

Segmentation for Guest, BYOD, IoT, IIoT, SCADA, ICS, and OT Risk, Compliance, Audit, Data Locality, PCI, and GDPR Network Attacks and Scenario Cues Attack-to-Mitigation PBQ Tables

13 Domain 4: Security Controls and Hardening (14%)

Firewalls, IDS, IPS, Security Zones, and Screened Subnets ACLs, Filtering, NAC, Hardening, and Key Management Deception Technologies and Physical Security Zero Trust, SASE, and Trusted or Untrusted Zone Decisions

14 Domain 5: Troubleshooting Methodology and Tools (24%)

Official Troubleshooting Methodology and Evidence Handling Command-Line Tools: ping, traceroute, nslookup, dig, ipconfig, ifconfig, ip, arp, netstat, ss, and route Packet, Protocol, and Wi-Fi Analyzers Choosing the Right Tool by Symptom PBQs

15 Domain 5: Physical, Interface, and Wireless Troubleshooting (24%)

Cable Issues: Type, Attenuation, Crosstalk, Termination, and TX/RX Interface Issues: Errors, Discards, Duplex, Speed, Port Status, and PoE Transceiver, Fiber, and Signal Strength Troubleshooting Wireless Troubleshooting: Interference, Channels, Roaming, RSSI/SNR, Security, and Captive Portals

16 Domain 5: Network Services, Switching, Routing, and Performance Troubleshooting (24%)

DHCP, DNS, NTP, and IP Addressing Issues VLAN, STP, Trunk, Native VLAN, and ACL Issues Routing, Default Gateway, Route Table, and NAT Issues Congestion, Latency, Jitter, Packet Loss, and Application Performance Clues

17 Performance-Based Question Labs

Subnetting and VLSM Design Lab VLAN, Trunk, Router-on-a-Stick, and Firewall Rule Lab Wireless Deployment and Troubleshooting Lab Monitoring, Log Triage, and Route or Service Troubleshooting Lab

18 High-Yield Reference and Final Study Plan

High-Yield Ports and Protocols Table Wi-Fi, Cabling, Connectors, and Transceivers Quick Table Acronyms and Command-Line Tool Quick Table Final 7-Day Review Plan and Readiness Checklist

19 Final Synthesis: Strategy, Remediation, and Readiness

Mixed-Set Decision Strategy for Qualifiers and Close Answers Missed-Question Remediation Notebook by Error Type Exam-Day Time Management and PBQ Order 100-Question Readiness Simulation Blueprint Mapped to N10-009 Weights

High-Yield Ports and Protocols Table

Key Takeaways Explain This Topic AI

Port items on N10-009 test the service, its transport (TCP vs UDP), the secure alternative, and the troubleshooting implication, not raw memorization.

Know administrative, web, name-resolution, email, file-transfer, directory, time, and monitoring ports cold because they recur in scenario stems.

TCP is connection-oriented (handshake, ordered delivery); UDP is low-overhead and used for DNS queries, DHCP, NTP, SNMP, TFTP, and streaming.

Secure replacements such as SSH (22), HTTPS (443), SFTP (22), SNMPv3, LDAPS (636), and IMAPS (993)/POP3S (995) are frequent correct answers.

When a service fails, work the order: DNS resolution, Layer 3 reachability, port filtering, service status, then authentication.

Last updated: June 2026

High-Yield Ports and Protocols

The CompTIA Network+ N10-009 exam (up to 90 questions in 90 minutes, passing score 720 on a 100–900 scale) expects you to recognize a service from its port, pick the safer alternative, and use port behavior to drive troubleshooting. Objective 1.4 explicitly lists ports and protocols, and they reappear inside Security and Troubleshooting items. Do not memorize the table as isolated trivia—tie each port to a symptom and a transport.

Transport matters. TCP (Transmission Control Protocol) is connection-oriented: it performs the three-way handshake (SYN, SYN-ACK, ACK), guarantees ordered delivery, and retransmits lost segments. UDP (User Datagram Protocol) is connectionless and lightweight, so it carries DNS queries, DHCP, NTP, SNMP, TFTP, and real-time voice/video where retransmission would add harmful delay.

Core Reference Table

  • Service Port Transport What it does Exam cue
  • FTP data 20 TCP File-transfer data channel Legacy clear-text transfer
  • FTP control 21 TCP File-transfer commands Use SFTP or FTPS when secure
  • SSH 22 TCP Secure shell and tunneling Secure admin access
  • SFTP 22 TCP File transfer over SSH Secure FTP replacement
  • Telnet 23 TCP Clear-text remote shell Never for secure admin
  • SMTP 25 TCP Server-to-server mail Outbound relay/filtering
  • DNS 53 UDP/TCP Name resolution; zone transfers UDP for queries, TCP for zone transfer
  • DHCP server/client 67/68 UDP IPv4 address assignment APIPA = DHCP failure
  • TFTP 69 UDP Trivial file transfer Device boot/config, no security
  • HTTP 80 TCP Unencrypted web Redirect to HTTPS
  • Kerberos 88 UDP/TCP Authentication tickets Time-sensitive (NTP dependency)
  • NTP 123 UDP Time sync Certs, logs, Kerberos depend on it
  • SNMP 161 UDP Monitoring queries Prefer SNMPv3
  • SNMP trap 162 UDP Device-initiated alert Device-to-manager alert
  • LDAP 389 TCP/UDP Directory queries No TLS by default
  • HTTPS 443 TCP Encrypted web/API Secure mgmt page
  • SMB 445 TCP Windows file/printer share Lateral-movement target
  • Syslog 514 UDP/TCP Log forwarding Centralized logging
  • LDAPS 636 TCP LDAP over TLS Secure directory
  • IMAPS 993 TCP Secure mailbox retrieval Leaves mail on server
  • POP3S 995 TCP Secure mailbox retrieval Downloads mail
  • SQL (MS) 1433 TCP Microsoft SQL Server DB connectivity
  • RDP 3389 TCP/UDP Remote desktop Restrict exposure
  • SIP 5060/5061 TCP/UDP VoIP signaling 5061 commonly TLS
  • Troubleshooting With Ports
  • Symptom Useful check
  • Name fails before connecting DNS on 53, resolver config, records
  • Resolves but browser times out TCP 443 reachability, firewall logs, service status
  • Device has APIPA (169.254.x.x) DHCP path, relay, scope, VLAN, UDP 67/68
  • Secure switch admin fails SSH on 22, management ACL, AAA
  • File share unavailable SMB 445, name resolution, share permissions
  • No device metrics in monitoring SNMP version, community/credentials, ACL, UDP 161
  • Clocks drift, certs/logs misbehave NTP on UDP 123, stratum source
  • Secure Alternatives
  • Telnet → SSH (encrypted remote administration)
  • FTP → SFTP or FTPS (protects credentials and file contents)
  • HTTP login → HTTPS (protects sessions and credentials)
  • SNMPv1/v2c → SNMPv3 (adds authentication and privacy)
  • LDAP → LDAPS or LDAP with StartTLS (protects directory traffic)
  • Worked Scenario: Email Client Cannot Receive Mail

A user reports that Outlook can send but not receive. The send path uses SMTP, so outbound on port 25 (or the submission port) is healthy. Receiving uses either IMAP or POP3. Modern, secure clients should retrieve mail over IMAPS (993) or POP3S (995) , both encrypted with TLS. If the client was configured for legacy plaintext IMAP (143) or POP3 (110) and the mail provider disabled clear-text retrieval, the symptom is exactly "send works, receive fails." The fix is to reconfigure the account to the secure retrieval port, which also explains why N10-009 pairs each clear-text port with its TLS counterpart.

Notice the diagnostic logic: identify the function (receive), map it to candidate protocols (IMAP/POP3), then check whether the secure or insecure variant is required by policy.

Why Time and Authentication Ports Recur

Two ports show up far more often than their obscurity suggests. NTP (UDP 123) underpins certificate validation, log correlation, and Kerberos. If clocks drift more than five minutes, Kerberos (UDP/TCP 88) rejects tickets and certificate checks may fail, producing login errors that look unrelated to time. RADIUS centralizes authentication for VPN, 802.1X wired ports, and Wi-Fi; a failed RADIUS path makes every downstream service appear broken even though the underlying network is fine.

When a stem describes widespread authentication failures after a server change, suspect NTP or the AAA server before blaming individual application ports.

Common Traps

Assuming DNS is UDP only; TCP 53 is used for zone transfers and oversized responses.

Confusing SSH and SFTP because both ride TCP 22.

Treating a closed port as proof that routing is broken.

Exposing RDP (3389) broadly instead of restricting source networks or using a jump host.

Forgetting that application authentication can fail even when the port is reachable.

Choosing Telnet or FTP when the stem says "secure" management or transfer.