ExamSprintLab

Network port practice questions with answers

Updated October 9, 2026

Fifteen free network port practice questions with explained answers, checked against the IANA service name and port number registry. A port number identifies the service a TCP or UDP packet is addressed to, and exams expect the well-known ports plus the secure alternative for each insecure protocol. The topic is tested in CompTIA Network+ (N10-009) and CompTIA Security+ (SY0-801).

How to use these questions

Answer first, then open the explanation. Note the constraint in the stem: transport (TCP or UDP), direction (client to server or server to client), and whether encryption is required. Wrong options are explained too, so they double as a mini port list. The common ports cheat sheet holds the full table for review.

Warm-up: the ports everyone must know

Question 1. Users must browse an internal site over HTTPS using its default port. Which TCP port must the firewall allow to the web server?

  • A. 80
  • B. 8080
  • C. 443
  • D. 8443
Show answer

Answer: C

HTTPS uses TCP 443 by default. TCP 80 is plain HTTP. 8080 is a common alternative HTTP port (http-alt) and 8443 is a common alternative for HTTPS, but neither is the default.

Question 2. A security audit flags a legacy switch that accepts unencrypted remote command-line logins. Which default TCP port does that service use?

  • A. 23
  • B. 22
  • C. 25
  • D. 21
Show answer

Answer: A

Telnet uses TCP 23 and sends credentials in clear text. SSH on 22 is the encrypted replacement. 25 is SMTP and 21 is the FTP control channel.

Question 3. A secondary DNS server must copy a zone from the primary server (a zone transfer). Which protocol and port are used?

  • A. UDP 67
  • B. UDP 123
  • C. UDP 161
  • D. TCP 53
Show answer

Answer: D

Zone transfers use TCP 53, because they are too large and need reliable delivery. Ordinary small queries use UDP 53. UDP 67 is the DHCP server, UDP 123 is NTP, and UDP 161 is SNMP.

Question 4. On which UDP port does a DHCP server listen for requests from clients?

  • A. 68
  • B. 67
  • C. 69
  • D. 53
Show answer

Answer: B

DHCP servers listen on UDP 67 and clients receive replies on UDP 68. 69 is TFTP and 53 is DNS.

Question 5. An administrator needs to open a firewall rule so support staff can use Remote Desktop Protocol to reach a Windows server. Which TCP port is required?

  • A. 445
  • B. 5900
  • C. 3389
  • D. 1433
Show answer

Answer: C

RDP uses TCP 3389 (ms-wbt-server). 445 is SMB file sharing, 5900 is VNC (rfb), and 1433 is Microsoft SQL Server.

Scenarios: choosing the right port for the job

Question 6. An email client must submit outgoing mail to the company mail server using authentication and STARTTLS. Which port is the standard for this client submission?

  • A. 25
  • B. 110
  • C. 143
  • D. 587
Show answer

Answer: D

Message submission from clients uses TCP 587 (submission). TCP 25 is for server-to-server SMTP relay. 110 is POP3 and 143 is IMAP, both of which are for retrieving mail, not sending it.

Question 7. Routers and switches must send log messages to a central syslog collector using the traditional syslog transport. Which port is used?

  • A. UDP 514
  • B. UDP 161
  • C. UDP 162
  • D. TCP 389
Show answer

Answer: A

Traditional syslog uses UDP 514. SNMP polling uses UDP 161 and SNMP traps use UDP 162, which are different services. LDAP on 389 is a directory service.

Question 8. A network device sends an unsolicited SNMP trap to the management station. To which destination port is the trap sent?

  • A. UDP 161
  • B. UDP 162
  • C. UDP 514
  • D. UDP 123
Show answer

Answer: B

SNMP traps and informs go to the manager on UDP 162. UDP 161 is where the agent listens for polling requests from the manager. 514 is syslog and 123 is NTP.

Question 9. An application must query Active Directory using LDAP wrapped in TLS from the start of the connection, on the dedicated secure LDAP port. Which TCP port is that?

  • A. 389
  • B. 88
  • C. 445
  • D. 636
Show answer

Answer: D

LDAPS uses TCP 636. TCP 389 is plain LDAP (StartTLS can upgrade it, but it is not the dedicated TLS port). 88 is Kerberos and 445 is SMB.

Question 10. Several servers show Kerberos authentication failures because their clocks have drifted. The firewall blocks outbound traffic to the internal time server. Which port must be allowed for time synchronisation?

  • A. UDP 53
  • B. UDP 69
  • C. UDP 123
  • D. UDP 161
Show answer

Answer: C

NTP uses UDP 123. 53 is DNS, 69 is TFTP and 161 is SNMP. None of those synchronise clocks.

Edge cases and traps: secure variants and tunnels

Question 11. To contain ransomware spreading between Windows hosts, an engineer wants to block Windows file sharing that runs directly over TCP, without NetBIOS. Which port is blocked?

  • A. TCP 25
  • B. TCP 445
  • C. TCP 3306
  • D. TCP 143
Show answer

Answer: B

SMB directly over TCP uses port 445 (microsoft-ds). 25 is SMTP, 3306 is MySQL and 143 is IMAP, none of which carry Windows file sharing.

Question 12. A partner requires secure file transfer that runs inside an SSH session, so that only one inbound port has to be opened. Which port should be allowed?

  • A. TCP 22
  • B. TCP 21
  • C. TCP 990
  • D. TCP 20
Show answer

Answer: A

SFTP runs over SSH and uses TCP 22 for everything. TCP 21 is the FTP control channel and 20 is FTP active-mode data, both of which are unencrypted FTP. TCP 990 is FTPS (FTP over TLS) and is a separate protocol that is not SSH-based.

Question 13. A VoIP deployment must protect SIP call signalling with TLS. Which default TCP port is used for SIP over TLS?

  • A. 5060
  • B. 5004
  • C. 5061
  • D. 443
Show answer

Answer: C

SIP over TLS (sips) uses TCP 5061, while unencrypted SIP uses 5060. 5004 is a commonly used media (RTP) port, not signalling, and 443 is HTTPS.

Question 14. A web application tier must connect to the default instance of Microsoft SQL Server. Which TCP port must be opened between them?

  • A. 1433
  • B. 3306
  • C. 5432
  • D. 3389
Show answer

Answer: A

The default instance of SQL Server listens on TCP 1433 (ms-sql-s). MySQL uses 3306, PostgreSQL uses 5432, and 3389 is RDP.

Question 15. A site-to-site IPsec VPN has one peer behind a NAT device. Besides UDP 500 for IKE, which UDP port is used once NAT traversal is detected?

  • A. UDP 1701
  • B. UDP 4500
  • C. TCP 1723
  • D. UDP 123
Show answer

Answer: B

IPsec NAT traversal encapsulates ESP in UDP and moves IKE to UDP 4500. UDP 1701 is L2TP, TCP 1723 is PPTP, and UDP 123 is NTP. Note that ESP itself is IP protocol 50, not a port number.

Where to go next

Review the common ports cheat sheet and then practise related material with OSI model practice questions and ACL practice questions. For a timed attempt, take the free 20-question Network+ practice test, and read the multiple-choice exam tips.