A company exchanges payroll files with a partner using plain FTP over the internet. An audit finds that usernames, passwords, and file contents can be captured by anyone on the network path. Which replacement BEST addresses this finding?
Select an answer to reveal the explanation.
Short Explanation
Plain FTP is like shouting your PIN across a crowded room; every eavesdropper hears it. SFTP wraps the whole conversation you're having, login and file, inside an encrypted SSH session. Don't fall for TFTP; it drops authentication entirely and still sends everything in the clear.
Full Explanation
Plain FTP transmits usernames, passwords, commands, and file contents unencrypted, so anyone able to observe the network path can capture them. SFTP, the SSH File Transfer Protocol, carries both authentication and data inside an encrypted, integrity-protected SSH session, which directly addresses the audit finding. It also supports key-based authentication, which can replace shared passwords between partners. TFTP is a minimal protocol designed for simple transfers on local networks, such as loading device configurations; it has no authentication and no encryption, so it removes the credential exposure only by removing access control entirely while leaving file contents readable. Longer, regularly rotated passwords make guessing harder but do nothing to stop interception, because a captured password is still valid until the next rotation and the payroll data remains exposed in transit. Restricting FTP to the partner's IP address limits who can connect, but traffic between the two parties still crosses the internet in cleartext and can be captured on the path. Exam caveat: FTPS, which adds TLS to FTP, also encrypts the session, so the key concept is protecting credentials and data in transit rather than any single protocol name. Operational check: migrate the partner to SFTP with key authentication, disable the plain FTP service, and capture a test transfer to confirm no credentials or file contents appear in cleartext.