Your network contains a server named Server1 that runs Windows Server 2008 R2.
The network contains two sites named Site1 and Site2 that are separated by a firewall.
Server1 is configured as a Key Management Service (KMS) host located in Site1.

You need to configure the firewall so that computers in Site2 can activate Windows by using Server1.

Which TCP port should you allow through the firewall?

A.
135

B.
443

C.
1433

D.
1688

Explanation:
KMS requires a firewall exception on the KMS host. If using the default TCP port, enable the KMS Traffic exception in Windows Firewall. If using a different firewall, open TCP port 1688. If using a non-default port, open the custom TCP port in the firewall.

Source: http://technet.microsoft.com/en-us/library/ff793409.aspx