Ports and Protocol Decision Table

Ports Become Useful in Context

The N10-009 objectives explicitly list ports/protocols, and they appear in firewall-rule and "which service failed" items. You rarely get a bare "what port is X" question; instead you must pick a secure management protocol, identify a blocked service, or write the rule that satisfies a requirement. Learn the well-known range (0-1023), then connect each entry to a use case.

Ports exist because a single IP address must host many services at once. The combination of an IP address and a port is a socket, and the pair of sockets (source and destination) plus the protocol uniquely identifies a connection, which is how one web server fields thousands of simultaneous sessions on TCP 443. Servers listen on well-known destination ports; clients open an ephemeral source port (commonly 49152-65535) for the return traffic.

Understanding this is what lets you read a firewall log or a netstat output: an entry showing a local ephemeral port talking to a remote 443 is an outbound HTTPS session, while a listener bound to 0.0.0.0:3389 is an exposed RDP service that the exam would flag as a hardening risk to restrict or move behind a VPN.

TCP vs. UDP and the Three-Way Handshake

TCP (Transmission Control Protocol) is connection-oriented and reliable: it opens a session with the SYN, SYN-ACK, ACK three-way handshake, numbers and acknowledges bytes, retransmits losses, and closes with FIN. UDP (User Datagram Protocol) is connectionless "fire and forget": no handshake, no acknowledgment, lower overhead. That trade-off drives protocol choice.

Secure Replacement Table

A recurring exam theme is swapping a cleartext protocol for its encrypted equivalent. If the requirement says "protect credentials in transit" or "encrypt management," pick the secure column.

Worked Firewall and Failure Scenarios

If a firewall allows TCP 443 but a web app still fails, confirm DNS (53) and that the server is actually listening on 443; a missing rule and a stopped service look identical from the client. Anchor every port to an operational story, that is how they appear on the test.

A handful of dependencies between these protocols generate exam questions on their own. NTP (UDP 123) is foundational: if device clocks drift, Kerberos (88) authentication fails because tickets are time-stamped, TLS certificates appear invalid, and log correlation across devices becomes useless, so a wave of seemingly unrelated auth and certificate errors often traces back to a single bad time source. DNS (53) underpins almost everything by name, so a DNS outage masquerades as a total network failure even though IP connectivity is fine, a fast check is to ping by IP address versus by name.

DHCP (UDP 67/68) is broadcast-based and therefore subnet-local, so cross-subnet leasing depends on a relay. Building these cause-and-effect chains, rather than memorizing isolated numbers, is what carries you through the multi-step firewall and troubleshooting items that dominate this objective.