ExamFinch.com My Study

Study guide

Ports and Protocol Decision Table

Practice this exam

CompTIA Network+ N10-009

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

Current Exam Facts and Applied Networking Judgment Official Domain Weights and an 8-12 Week Study Plan How to Use Labs, Practice, and PBQ Workflow Missed-Question Notebook and Final Readiness Metrics

2 Domain 1: Networking Concepts (23%)

OSI and TCP/IP Models with Device and Protocol Mapping Networking Appliances and Where They Operate Ports and Protocol Decision Table Traffic Types and Encapsulation Flow

3 Domain 1: Media, Connectors, Transceivers, and Network Architectures

Copper, Fiber, Coax, and DAC Media Connector and Transceiver Selection Network Topologies and Design Patterns Cloud and Virtual Networking Concepts

4 Domain 1: IP Addressing and Subnetting Mastery

IPv4 Classes, Private/Public, APIPA, and Loopback CIDR, VLSM, and Subnet Math IPv6 Address Types and Notation Routing Basics and Longest Prefix Match

5 Domain 2: Network Implementation - Routing

Static vs Dynamic Routing and Route Selection OSPF, EIGRP, and BGP Basics at Network+ Depth NAT/PAT, VIP/FHRP, and Subinterfaces Routing PBQs and Troubleshooting Route Table Clues

6 Domain 2: Network Implementation - Switching

VLANs, Access Ports, Trunks, and Native VLAN STP/RSTP Loop Prevention and Bridge Roles Port Aggregation/LACP, MTU, Jumbo Frames, and Interface Settings Switch Implementation PBQs and Common Misconfigurations

7 Domain 2: Network Implementation - Wireless and Physical Implementation

Wi-Fi Standards, Bands, and Channels SSID Security, Guest Networks, and Authentication Antennas, Coverage, Roaming, Interference, and Site Surveys Physical Installation Implications

8 Domain 2: Network Implementation - Services Implementation

DNS Record Types and Troubleshooting Cues DHCP, DHCPv6, SLAAC, Scopes, Leases, and Relay NTP, PTP, NTS, and Time-Sensitive Networking Service Implementation PBQs: DNS, DHCP, VLANs, and Firewall Direction

9 Domain 3 Part A: Network Operations Documentation and Governance

Physical, Logical, Rack, Cable, Wireless Diagrams, and IPAM Asset Inventory, Baselines, SLAs, SOPs, and Runbooks Change Management and Request Tracking Lifecycle, EOL, EOS, Decommissioning, and Configuration Management

10 Domain 3 Part B: Monitoring, Remote Access, and Resilience

SNMP, Flow, Syslog, Packet Capture, Log Aggregation, APIs, and Port Mirroring Baselines and Performance Metrics Remote Access, Management Paths, and Secure Admin Habits DR and HA Concepts: RPO, RTO, MTTR, MTBF, Sites, Failover, and Testing

11 Domain 4: Logical Security and Secure Access (14%)

Encryption in Transit, Encryption at Rest, PKI, and Certificates IAM, MFA, SSO, Directory Services, and AAA Authorization, Least Privilege, RBAC, Geofencing, and Time-Based Access VPNs and Secure Management Design

12 Domain 4: Segmentation, Risk, and Network Attacks (14%)

Segmentation for Guest, BYOD, IoT, IIoT, SCADA, ICS, and OT Risk, Compliance, Audit, Data Locality, PCI, and GDPR Network Attacks and Scenario Cues Attack-to-Mitigation PBQ Tables

13 Domain 4: Security Controls and Hardening (14%)

Firewalls, IDS, IPS, Security Zones, and Screened Subnets ACLs, Filtering, NAC, Hardening, and Key Management Deception Technologies and Physical Security Zero Trust, SASE, and Trusted or Untrusted Zone Decisions

14 Domain 5: Troubleshooting Methodology and Tools (24%)

Official Troubleshooting Methodology and Evidence Handling Command-Line Tools: ping, traceroute, nslookup, dig, ipconfig, ifconfig, ip, arp, netstat, ss, and route Packet, Protocol, and Wi-Fi Analyzers Choosing the Right Tool by Symptom PBQs

15 Domain 5: Physical, Interface, and Wireless Troubleshooting (24%)

Cable Issues: Type, Attenuation, Crosstalk, Termination, and TX/RX Interface Issues: Errors, Discards, Duplex, Speed, Port Status, and PoE Transceiver, Fiber, and Signal Strength Troubleshooting Wireless Troubleshooting: Interference, Channels, Roaming, RSSI/SNR, Security, and Captive Portals

16 Domain 5: Network Services, Switching, Routing, and Performance Troubleshooting (24%)

DHCP, DNS, NTP, and IP Addressing Issues VLAN, STP, Trunk, Native VLAN, and ACL Issues Routing, Default Gateway, Route Table, and NAT Issues Congestion, Latency, Jitter, Packet Loss, and Application Performance Clues

17 Performance-Based Question Labs

Subnetting and VLSM Design Lab VLAN, Trunk, Router-on-a-Stick, and Firewall Rule Lab Wireless Deployment and Troubleshooting Lab Monitoring, Log Triage, and Route or Service Troubleshooting Lab

18 High-Yield Reference and Final Study Plan

High-Yield Ports and Protocols Table Wi-Fi, Cabling, Connectors, and Transceivers Quick Table Acronyms and Command-Line Tool Quick Table Final 7-Day Review Plan and Readiness Checklist

19 Final Synthesis: Strategy, Remediation, and Readiness

Mixed-Set Decision Strategy for Qualifiers and Close Answers Missed-Question Remediation Notebook by Error Type Exam-Day Time Management and PBQ Order 100-Question Readiness Simulation Blueprint Mapped to N10-009 Weights

Ports and Protocol Decision Table

Key Takeaways Explain This Topic AI

Port knowledge is high yield only when tied to use case, transport (TCP/UDP), and the secure alternative.

TCP is connection-oriented (three-way handshake); UDP is connectionless, used for low-latency and query/response.

Secure protocols (SSH, SFTP, HTTPS, SNMPv3, LDAPS) replace cleartext management and transfer protocols.

Scenarios ask which port to allow on a firewall, which service failed, or which protocol fits a requirement.

Never memorize ports in isolation; attach each to a symptom and a design decision.

Last updated: June 2026

Ports Become Useful in Context

The N10-009 objectives explicitly list ports/protocols, and they appear in firewall-rule and "which service failed" items. You rarely get a bare "what port is X" question; instead you must pick a secure management protocol, identify a blocked service, or write the rule that satisfies a requirement. Learn the well-known range (0-1023) , then connect each entry to a use case.

Ports exist because a single IP address must host many services at once. The combination of an IP address and a port is a socket , and the pair of sockets (source and destination) plus the protocol uniquely identifies a connection, which is how one web server fields thousands of simultaneous sessions on TCP 443. Servers listen on well-known destination ports; clients open an ephemeral source port (commonly 49152-65535) for the return traffic.

Understanding this is what lets you read a firewall log or a netstat output: an entry showing a local ephemeral port talking to a remote 443 is an outbound HTTPS session, while a listener bound to 0.0.0.0:3389 is an exposed RDP service that the exam would flag as a hardening risk to restrict or move behind a VPN.

  • Protocol Port(s) Transport Use Decision clue
  • FTP (control/data) 21/20 TCP File transfer Cleartext; prefer SFTP/FTPS
  • SSH / SFTP 22 TCP Secure shell, secure file transfer Secure remote admin
  • Telnet 23 TCP Remote terminal Insecure cleartext, avoid
  • SMTP 25 TCP Server-to-server mail Mail relay
  • DNS 53 UDP/TCP Name resolution UDP for queries, TCP for zone transfer
  • DHCP 67/68 UDP Address leasing Client cannot get a lease
  • TFTP 69 UDP Simple file transfer No auth, network boot/configs
  • HTTP 80 TCP Web Cleartext web
  • Kerberos 88 TCP/UDP Authentication Time-sensitive AD auth
  • POP3 110 TCP Mail download Removes mail from server
  • NTP 123 UDP Time sync Drift breaks logs, certs, Kerberos
  • IMAP 143 TCP Mail access Mail stays on server
  • SNMP 161/162 UDP Monitoring/traps Prefer SNMPv3
  • LDAP 389 TCP/UDP Directory Cleartext directory queries
  • HTTPS 443 TCP Encrypted web TLS-secured web
  • SMB 445 TCP Windows file sharing File shares, domain access
  • Syslog 514 UDP/TCP Log forwarding Central logging
  • LDAPS 636 TCP Encrypted directory Secure LDAP
  • SQL Server 1433 TCP MS SQL Database access
  • RDP 3389 TCP/UDP Remote desktop GUI admin, restrict it
  • SIP 5060/5061 UDP/TCP/TLS VoIP signaling 5061 = TLS-secured SIP

TCP vs. UDP and the Three-Way Handshake

TCP (Transmission Control Protocol) is connection-oriented and reliable: it opens a session with the SYN, SYN-ACK, ACK three-way handshake, numbers and acknowledges bytes, retransmits losses, and closes with FIN. UDP (User Datagram Protocol) is connectionless "fire and forget": no handshake, no acknowledgment, lower overhead. That trade-off drives protocol choice.

  • Need Usually fits
  • Reliable, ordered delivery and session control TCP
  • Low overhead, real-time, query/response UDP
  • Name lookup DNS, UDP for queries, TCP for zone transfers
  • Address lease DHCP over UDP
  • Time sync NTP over UDP
  • Web session HTTP/HTTPS over TCP
  • Secure Replacement Table

A recurring exam theme is swapping a cleartext protocol for its encrypted equivalent. If the requirement says "protect credentials in transit" or "encrypt management," pick the secure column.

  • Weaker choice Secure replacement Why
  • Telnet (23) SSH (22) Encrypts remote administration
  • FTP (21) SFTP (22) or FTPS (990) Protects credentials and data
  • HTTP (80) HTTPS (443) TLS confidentiality and integrity
  • SNMPv1/v2c (161) SNMPv3 Adds authentication and encryption
  • LDAP (389) LDAPS (636) / StartTLS Protects directory queries
  • Worked Firewall and Failure Scenarios
  • Scenario Port/protocol focus
  • Securely administer a switch CLI SSH, TCP 22
  • Clients cannot obtain a DHCP lease across a router UDP 67/68 plus a DHCP relay/IP helper
  • Monitoring system cannot poll interface counters securely SNMPv3, UDP 161
  • Internal portal must protect credentials HTTPS, TCP 443
  • Directory bind exposes credentials in capture LDAPS, TCP 636, or StartTLS

If a firewall allows TCP 443 but a web app still fails, confirm DNS (53) and that the server is actually listening on 443; a missing rule and a stopped service look identical from the client. Anchor every port to an operational story, that is how they appear on the test.

A handful of dependencies between these protocols generate exam questions on their own. NTP (UDP 123) is foundational: if device clocks drift, Kerberos (88) authentication fails because tickets are time-stamped, TLS certificates appear invalid, and log correlation across devices becomes useless, so a wave of seemingly unrelated auth and certificate errors often traces back to a single bad time source. DNS (53) underpins almost everything by name, so a DNS outage masquerades as a total network failure even though IP connectivity is fine, a fast check is to ping by IP address versus by name.

DHCP (UDP 67/68) is broadcast-based and therefore subnet-local, so cross-subnet leasing depends on a relay. Building these cause-and-effect chains, rather than memorizing isolated numbers, is what carries you through the multi-step firewall and troubleshooting items that dominate this objective.