Which port allows RDP to a jump host?
Short answer
C Allow TCP 3389, the default Microsoft RDP port, so administrators can open a remote desktop session to the jump host for troubleshooting.
Question
Key Takeaways
The question tests default port-to-service recall and the trap is choosing a secure-sounding but unrelated port such as LDAPS 636 instead of RDP 3389.
A jump host for troubleshooting is reached with Microsoft Remote Desktop Protocol, so the firewall must allow TCP 3389; this page confirms option C and explains why 636, 1433, and 5061 are unrelated.
Common mistake: Selecting 636 because it sounds like a secure remote-access port is wrong; 636 is LDAPS for directory queries over TLS, not the Microsoft RDP service used to reach a jump host.
Expert Analysis
Protocol path from client to jump host
The scenario is an administrative access flow, not a directory lookup or database connection. The administrator's client starts a TCP connection to the jump host, and the firewall policy must match the destination port used by the remote-control service. On a Windows jump host, that service is Microsoft Remote Desktop Protocol, whose default listener is TCP 3389. After the SYN reaches the host and the TCP handshake completes, RDP negotiates encryption, authentication, and the graphical session. If the firewall rule lacks 3389, the connection fails before RDP login.
Why option C is correct
Option C, port 3389, is the default Microsoft RDP port. A community explanation correctly associates 3389 with RDP and says it is used for graphical desktop connections to servers or jump hosts for administration and troubleshooting. The firewall rule should be narrow: source = administrator network or VPN pool, destination = jump host, service = TCP 3389. The question asks about the default; if the jump host used a custom RDP listener, that custom port would need to be allowed instead, but no custom port is stated.
Why the other ports fail
Port 636 carries LDAPS, secure LDAP directory traffic, not an interactive desktop. Port 1433 is the default Microsoft SQL Server database listener. Port 5061 is SIP over TLS, used in voice and unified communications signaling. Allowing any of these would leave the RDP connection blocked. The familiar security label "secure" in LDAPS does not make 636 a remote-administration port.
Where the decision takes effect
Trace the path in order: administrator client -> firewall policy lookup -> jump host TCP/3389 -> RDP service -> authenticated desktop. The decisive step is firewall policy matching the destination port. Verification after the change should test TCP 3389 from the permitted source and confirm the RDP logon prompt; a port scan from an unapproved source should still fail. Restrict the rule with MFA/VPN and source-IP limits because exposing RDP broadly is risky.
Official Reference
- https://learn.microsoft.com/en-us/troubleshoot/windows-server/remote/change-remote-desktop-listening-port
- https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=3389
These links open the official vendor documentation in a new tab.
Exam Strategy
Build a small port map in your head by service family: remote desktop 3389, LDAPS 636, SQL Server 1433, SIP-TLS 5061. In scenario questions, identify the client-to-server interaction before choosing a port; "secure" in an option name is not evidence that it supports remote administration. Eliminate answers that belong to directory, database, or voice services, then verify that the remaining port matches the default for the stated protocol. This same method prevents confusing 389/636, 1433, and 5061 with RDP.
Frequently Asked Questions
Why should the firewall rule for RDP be limited to the jump host?
What services use ports 636, 1433, and 5061?
Should port 3389 be opened directly from the internet?
Community Votes
100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
ERB14 👍 1 Answered C3389 (Remote Desktop Protocol - RDP): Port 3389 is the default port used by Microsoft RDP to establish remote graphical desktop connections to servers or jump hosts for administration and troubleshooting.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All N10-009 Questions
Access 100 questions with complete answers and detailed explanations.
View Full N10-009 Practice Test →