During a recent security audit, a contracted penetration tester discovered the organization uses a number of insecure protocols. Which of the following ports should be disallowed so only encrypted protocols are allowed? (Select TWO).
Correct Answer: B,C
* Port 23 is used by Telnet, an insecure protocol that sends data in plain text over the network. Telnet should be replaced by SSH, which uses port 22 and encrypts the data.
* Port 69 is used by TFTP, an insecure protocol that transfers files without authentication or encryption.
* TFTP should be replaced by SFTP or FTPS, which use port 22 or 990 respectively and encrypt the data.
* Port 443 is used by HTTPS, a secure protocol that encrypts the data using SSL/TLS certificates. HTTPS should be preferred over HTTP, which uses port 80 and sends data in plain text.
* Port 587 is used by SMTP, a protocol that sends email messages. SMTP can be secured by using STARTTLS, which initiates encryption after the initial handshake. Alternatively, port 465 can be used for SMTPS, which encrypts the data from the start.
* Port 8080 is used by HTTP proxy, a protocol that allows clients to access web servers through an intermediary. HTTP proxy can be secured by using HTTPS proxy, which uses port 443 and encrypts the data.
References:
* CompTIA Network+ N10-008 Study Guide, Chapter 2: Network Protocols and Services, pages 62-63,
66-67, 69-70, 72-73, 75-76.
* Professor Messer's CompTIA N10-008 Network+ Course Notes, Section 2.1: Common TCP and UDP Ports, pages 16-17.
* Professor Messer's CompTIA N10-008 Network+ Training Course, Video 2.1: Common TCP and UDP Ports, 6.