N10-009 Question 52
Single answerSFTP / SSH: 22A network administrator is migrating a vendor file exchange process from FTP to a more secure method. The vendor says its application supports SFTP, and the security team wants the transfer encrypted without deploying a separate VPN. After the change, users report they can connect only when TCP port 22 is allowed through the firewall. Which protocol is the administrator using to meet the requirement?
- A
SFTP running over SSH
- B
FTPS using explicit TLS on port 21
- C
SCP using HTTPS on port 443
- D
TFTP using UDP port 69
Show answer and explanation
Correct answer: A
Explanation
The key detail is that SFTP is not the same as FTPS. SFTP stands for SSH File Transfer Protocol and runs within an SSH session, typically over TCP port 22. Because SSH provides encryption and authentication, SFTP is commonly used when organizations want secure file transfer without the complexity of FTP's separate control and data channels. By contrast, FTPS is standard FTP with TLS/SSL added, usually involving port 21 or 990 and potentially additional negotiated data ports. TFTP is insecure and unsuitable for sensitive transfers. SSH documentation and common vendor implementation guides consistently identify TCP 22 as the default port for both SSH remote access and SFTP services.
- A. Correct.
Correct. SFTP is the SSH File Transfer Protocol, and it operates over SSH, typically using TCP port 22. It provides encrypted file transfer and command/control traffic within the SSH session, which matches the scenario requirement for secure transfer without a separate VPN.
- B. Incorrect.
Incorrect. FTPS is FTP secured with TLS/SSL, but it does not normally rely solely on TCP port 22. Explicit FTPS typically uses port 21 for control plus additional ports for data connections. This is a common confusion because both SFTP and FTPS are secure file transfer methods, but they are different protocols.
- C. Incorrect.
Incorrect. SCP is a secure file-copy method that runs over SSH, not HTTPS. While SCP can use TCP port 22 through SSH, the option is wrong because it incorrectly states HTTPS on port 443. Also, the scenario specifically says the vendor application supports SFTP.
- D. Incorrect.
Incorrect. TFTP uses UDP port 69 and provides no native encryption or strong authentication. It is designed for lightweight file transfer, often in boot or provisioning workflows, and does not meet the security requirement described.