220-1101 Question 58
Single answer20-21 – File Transfer Protocol (FTP)A technician is helping a remote employee upload large log files to a vendor's server using an FTP client. The employee can connect to the server and authenticate successfully, but every directory listing and file upload fails. The workstation is behind a small office firewall that only allows outbound traffic on TCP port 21. Which of the following changes is MOST likely to resolve the issue while keeping the connection as secure and functional as possible?
- A
Configure the FTP client to use passive mode and allow the related outbound data connections through the firewall
- B
Change the FTP client to use Telnet instead of FTP so file transfers stay on port 21 only
- C
Open inbound TCP port 3389 on the firewall so the FTP server can initiate the data channel
- D
Disable user authentication on the FTP server so directory listings can complete without additional negotiation
Show answer and explanation
Correct answer: A
Explanation
FTP commonly uses TCP port 21 for the control connection, but it also requires a separate data connection for commands such as directory listing and file transfer. In active FTP, the server initiates the data connection back to the client, which often fails when the client is behind NAT or a restrictive firewall. In passive FTP, the server listens on a server-side port and the client initiates the data connection, which is much more compatible with modern firewalls. From a troubleshooting perspective, a successful login combined with failed listings or uploads strongly suggests a problem with the FTP data channel rather than credentials. Best practice is to use passive mode when clients are behind firewalls and to permit the necessary outbound connections. This aligns with standard FTP behavior described in vendor and networking documentation for FTP clients, firewalls, and NAT environments.
- A. Correct.
Correct. Standard FTP uses separate control and data connections. While the control session commonly uses TCP port 21, directory listings and file transfers require a data channel. In environments with client-side firewalls or NAT, passive mode is typically the best choice because the client initiates both the control connection and the data connection to the server. That avoids the server attempting to open a connection back to the client, which is often blocked.
- B. Incorrect.
Incorrect. Telnet is a remote terminal protocol, not a file transfer solution for this scenario. It does not replace FTP for practical file uploads, and it is also insecure because it sends data in clear text. Choosing Telnet reflects a misunderstanding of protocol purpose.
- C. Incorrect.
Incorrect. TCP port 3389 is used for Remote Desktop Protocol (RDP), not FTP data channels. Opening 3389 would not help FTP transfers work. Also, the issue described is specifically related to FTP's separate data connection behavior, not remote desktop access.
- D. Incorrect.
Incorrect. Authentication is not the problem because the user can already connect and log in successfully. Directory listings and uploads fail because the data channel is not being established properly. Disabling authentication would reduce security and would not address the underlying FTP connectivity issue.