Port Ranges & Matching for A+
Short answer
Ports are numeric endpoints that route traffic to a specific application on a host. Well-known ports (0-1023) are commonly used by standard services. Registered ports (1024-49151) can be assigned to applications. Dynamic/ephemeral ports (49152-65535) are typically assigned by clients as temporary source ports when initiating connections. In troubleshooting, the destination port indicates the server/service, while the source port is usually a transient client value and not itself the service identifier.
Why it appears on the exam
- Given a packet log showing destination port 80 and source port 54823, ask which service is being accessed and whether the high source port indicates a problem. (Answer: HTTP is being accessed; high source port is normal client ephemeral port.) - Given a scenario where a firewall blocks outbound connections from ephemeral ports, ask why that may break client-initiated sessions.
Key concepts
Concept 1
Required terms
Well-known ports (0-1023): Ports reserved for common system services and well-known protocols; typically the destination port for server applications. Registered ports (1024-49151): Ports that can be registered for specific applications; often used by user-level services. Dynamic/ephemeral ports (49152-65535): Temporary ports typically chosen by client systems as source ports when initiating connections. Destination port vs Source port: Destination port identifies the server/service being accessed; source port is the client's temporary endpoint for the session.
Example
Web client connects to server: destination port 443 (HTTPS), source port some high number like 52345 (ephemeral).
Concept 2
How Port Ranges & Matching works
Ports are numeric endpoints that route traffic to a specific application on a host. Well-known ports (0-1023) are commonly used by standard services. Registered ports (1024-49151) can be assigned to applications. Dynamic/ephemeral ports (49152-65535) are typically assigned by clients as temporary source ports when initiating connections. In troubleshooting, the destination port indicates the server/service, while the source port is usually a transient client value and not itself the service identifier.
Example
Server logs show incoming connections to port 3389 -> RDP service likely targeted.
Concept 3
Common confusion
- Treating unfamiliar high source ports as suspicious when they often represent normal client behavior. - Expecting all services to use well-known ports; many enterprise or vendor applications use registered ports.
Example
Web client connects to server: destination port 443 (HTTPS), source port some high number like 52345 (ephemeral).
Concept 4
Core 1 (220-1201) question cues
Given a packet log showing destination port 80 and source port 54823, ask which service is being accessed and whether the high source port indicates a problem. (Answer: HTTP is being accessed; high source port is normal client ephemeral port.); Given a scenario where a firewall blocks outbound connections from ephemeral ports, ask why that may break client-initiated sessions.
Example
Server logs show incoming connections to port 3389 -> RDP service likely targeted.
Sample questions
Select an answer to reveal the explanation. For tracked practice and weak-area review, use the Cultiv8 app.
Q1.In an A+ question, this detail appears: Web client connects to server: destination port 443 (HTTPS), source port some high number like 52345 (ephemeral). Which option matches it?
Q2.For this A+ objective, the scenario says: Server logs show incoming connections to port 3389 -> RDP service likely targeted. What is the best match?
Q3.A user reports this support situation: Temporary ports typically chosen by client systems as source ports when initiating connections. Which option should the technician choose?
Practice this lesson in Cultiv8
The app adds tracked practice, targeted remediation, saved session history, and future readiness scoring.
Continue in Cultiv8