A company's policy requires employees to perform file transfers using protocols which encrypt traffic. You suspect some employees are still performing file transfers using unencrypted protocols becaus

FTP (File Transfer Protocol) uses TCP port 21 for control connections and transmits credentials and data in plaintext, making it the unencrypted file transfer protocol employees may be using in violation of policy. The Wireshark display filter tcp.port == 21 correctly captures FTP control channel traffic for analysis. No other answer choice exclusively targets an unencrypted file transfer protocol.

TCP port 23 is used by Telnet, which is an unencrypted remote terminal protocol, not a file transfer protocol, so this filter would not reveal unencrypted file transfers.

Adding tcp.port == 22 to the filter also captures SFTP and SCP traffic, which are encrypted file transfer protocols running over SSH, so the filter returns both encrypted and unencrypted transfers rather than isolating violations.

The filter tcp.port != 21 excludes all FTP traffic and captures everything else, which would show encrypted protocols such as SFTP (port 22) or FTPS (port 990) rather than isolating unencrypted file transfers.