N10-009 Question 51
Single answerFTP: 20/21A network administrator deploys a new perimeter firewall and soon receives complaints that users can connect to an external FTP server and authenticate successfully, but directory listings and file transfers fail. Packet captures show the client establishing a session to the server on TCP port 21, but the data connection is not completing. The firewall team wants the smallest rule change that matches standard FTP behavior. Which action should the administrator take?
- A
Allow outbound TCP port 20 from the client to the FTP server
- B
Allow inbound TCP port 20 from the FTP server to the client
- C
Allow inbound UDP port 21 from the FTP server to the client
- D
Allow outbound TCP port 22 from the client to the FTP server
Show answer and explanation
Correct answer: B
Explanation
This scenario describes classic active FTP behavior. FTP uses a control channel on TCP port 21. For active mode, the client connects to the server on port 21, authenticates, and then tells the server which client port to use for data. The server then initiates the data connection from its TCP port 20 back to the client. If authentication works but directory listings and transfers fail after a firewall change, the firewall is likely permitting the control channel while blocking the inbound data channel. The smallest standard fix is to allow inbound TCP port 20 from the FTP server to the client. This aligns with traditional FTP operation documented in RFC 959. In practice, many modern firewalls also use FTP inspection/helper features because FTP embeds addressing information in the control stream, and passive mode is often preferred through firewalls since the client initiates both connections.
- A. Incorrect.
Incorrect. In standard active FTP, TCP port 20 is used by the FTP server as the source port for the data connection, and that connection is initiated from the server back to the client. Allowing outbound TCP 20 from the client reflects a common misconception that both FTP channels originate from the client. The control connection does originate from the client to TCP 21, but the active-mode data connection does not.
- B. Correct.
Correct. FTP uses TCP port 21 for the control channel. In active FTP, after the client authenticates and requests data, the server initiates the data connection back to the client from TCP port 20. If users can log in but cannot list directories or transfer files, a firewall blocking the inbound server-to-client data channel is a likely cause. Allowing inbound TCP port 20 from the FTP server to the client matches classic FTP behavior with the smallest targeted change.
- C. Incorrect.
Incorrect. FTP uses TCP, not UDP, for both control and data channels. Port 21 is the control connection port, but permitting inbound UDP 21 would not help because the session shown in the capture is already established over TCP 21. This distractor targets confusion between transport protocols and firewall rule direction.
- D. Incorrect.
Incorrect. TCP port 22 is used by SSH and by SFTP, which is a different protocol from FTP. Although SFTP is often recommended as a secure alternative, changing firewall rules for port 22 would not fix a broken standard FTP deployment that is already successfully connecting on TCP 21.