A partner uploads nightly data files to the company using FTP. An audit finds that the partner's login credentials and the file contents cross the network in clear text. The partner's systems support SSH. Which replacement best addresses the finding?
Select an answer to reveal the explanation.
Short Explanation
Plain FTP is like shouting your password across a crowded room. SFTP runs the same kind of file transfer inside an SSH tunnel, so the login and the data are both encrypted. Changing the port is just shouting from a different corner of the room; everybody can still hear you.
Full Explanation
The SSH File Transfer Protocol (SFTP) runs file transfer operations as a subsystem of Secure Shell, so authentication and every byte of data travel inside an encrypted, integrity-protected channel. Because the partner already supports SSH, switching the nightly upload to SFTP removes clear-text credentials and clear-text file contents in one change, and it can use key-based authentication instead of passwords. Running FTP on a nonstandard port changes nothing about encryption; anyone capturing the traffic still sees the credentials and data, and security through obscurity does not satisfy an audit finding. TFTP is a minimal protocol without authentication or encryption; removing the login step makes the transfer less secure, not more, and TFTP is unsuitable for exchanging data with an external party. SMBv1 is an obsolete, insecure version of the Server Message Block protocol that should be disabled, and exposing file shares to an external partner over the internet introduces serious risk. Exam caveat: SFTP and FTPS are different protocols; SFTP rides on SSH, whereas FTPS adds TLS to FTP, and both encrypt, but the scenario's SSH support points to SFTP. Operational check: confirm the partner connects with key-based SFTP, verify that plain FTP is disabled on the server, and review a packet capture to show that credentials are not visible.