DRAG DROP
A company deploys an Office 365 tenant. All employees use Lync Online.
You need to configure the network firewall to support Lync Online.
Which ports must you open? To answer, drag the appropriate port number to the correct feature or
features. Each port number may be used once, more than once, or not at all. You may need to drag the
split bar between panes or scroll to view content.
Answer: 
Explanation:
http://onlinehelp.microsoft.com/en-ca/office365-enterprises/hh416761.aspx
433 and 5223, correct. See https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US#bkmk_lyo for complete overview of all the ports used by any of the Office 365 services.
*443
3478 is also required, So this is confusing.
Required: Audio
TCP 443, UDP 3478, 3479, 3480, & 3481, TCP/UDP 50,000-59,999
Required: Video
TCP 443, UDP 3478, 3479, 3480, & 3481, TCP/UDP 50,000-59,999
Required: Desktop sharing
TCP 443, UDP 3478, 3479, 3480, & 3481, TCP/UDP 50,000-59,999
Required: Lync Mobile push notifications for Lync Mobile 2010 on iOS devices. You don’t need this for Android, Nokia Symbian or Windows Phone mobile devices.
TCP 5223
443 will be used for authentication but for media flow 3478 must be opened.
I think it’s 3478 and 5223