If you do not want to expose your Security Center servers publicly, you can override those ports so that only the Web App Server role is accessible.
By default, the Web App Server role uses ports 80 and 443.
If you do not want to expose your Security Center servers publicly, you can override those ports so that only the Web App Server role is accessible.