N10-009 Question 53
Single answerSFTP / SSH: 22A systems administrator must allow a third-party vendor to securely upload nightly billing files to a Linux server in the company's DMZ. The security team requires both encrypted authentication and encrypted file transfers, and they want to avoid exposing unnecessary services through the firewall. Which of the following is the BEST configuration to meet these requirements?
- A
Allow TCP 22 to the server and have the vendor use SFTP over SSH
- B
Allow TCP 21 and a range of high-numbered ports to the server and have the vendor use FTPS
- C
Allow TCP 20 and TCP 21 to the server and have the vendor use FTP with IPsec
- D
Allow TCP 23 to the server and have the vendor transfer files through a Telnet session
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use SFTP over SSH on TCP port 22. SFTP is the SSH File Transfer Protocol, which operates through the SSH service and provides confidentiality and integrity for both credentials and transferred files. This makes it well suited for securely exchanging files with external vendors while keeping firewall rules simple. By contrast, FTPS is a different secure file-transfer method that often requires additional ports for data channels, making firewall configuration more complex. FTP and Telnet are not secure by themselves because they transmit sensitive data in cleartext. Best practices from SSH implementation guidance and general security standards favor encrypted management and file-transfer protocols, and Network+ commonly expects candidates to associate SSH and SFTP with TCP port 22.
- A. Correct.
Correct. SFTP runs over SSH and uses TCP port 22. This provides encrypted authentication and encrypted file transfer in a single protocol, which aligns with the requirement to minimize exposed services. From a firewall perspective, opening TCP 22 to the destination host is typically sufficient for standard SFTP access.
- B. Incorrect.
Incorrect. FTPS can provide encrypted file transfers, but the scenario specifically focuses on SFTP/SSH on port 22 and minimizing exposed services. Traditional FTPS commonly requires TCP 21 plus additional negotiated data ports, which increases firewall complexity and exposes more ports than necessary. Someone might choose this because FTPS is also secure, but it is not the best fit for the stated requirements.
- C. Incorrect.
Incorrect. Standard FTP uses TCP 20 and TCP 21, but FTP by itself does not encrypt authentication or file contents. While IPsec can protect traffic at the network layer, this is not the typical or simplest solution for a vendor file-transfer requirement, and it does not match the requirement to use the most appropriate single service exposure. This option reflects a common misconception that adding IPsec makes FTP the preferred secure file-transfer choice in all cases.
- D. Incorrect.
Incorrect. Telnet uses TCP 23 and does not provide encryption for authentication or session data. It is not appropriate for secure file transfer and would violate the requirement for encrypted authentication and encrypted transfers. Candidates may select this if they confuse remote terminal access with secure file-transfer functionality.