Although FTP traffic is not encrypted by default, which layer 3 protocol would allow for end-to-end encryption of the connection?

IPsec (Internet Protocol Security) operates at OSI Layer 3 and encrypts and authenticates all IP packets, making it transparent to higher-layer protocols such as FTP without requiring any modification to the FTP application. Because encryption is applied at the network layer, it provides end-to-end protection across any underlying network path. IPsec can be deployed in transport mode for host-to-host encryption or tunnel mode for gateway-to-gateway encryption, both of which fully encapsulate and protect the FTP data stream.

SFTP is an application-layer file transfer protocol built over SSH that replaces FTP entirely rather than encrypting a Layer 3 connection.

FTPS secures FTP using TLS, which operates at the Transport/Session layer (Layers 4-5), not at Layer 3.

SSL operates at the Transport/Session layer (Layers 4-5) and is not a Layer 3 protocol, so it cannot provide network-layer encryption for arbitrary IP traffic.