Anne, an administrator, notices unusual activity on a database server. After reviewing the logs, she notices a number of successful anonymous FTP logins and transferring of data to an external…

Changing default account settings addresses credential-based risks but does not disable the FTP service or patch the underlying vulnerability that permitted anonymous logins.

Applying up-to-date OS patches closes known vulnerabilities in the FTP service or underlying OS that can enable anonymous access and unauthorized data transfer. Without current patches, documented exploits remain available to attackers, allowing the anonymous login observed in the logs.

A NIDS can detect and alert on suspicious FTP activity after the fact but does not actively block sessions or prevent data exfiltration from occurring.

If the FTP service was not required for business operations, disabling it entirely removes the attack surface and prevents any FTP-based login - anonymous or otherwise - from succeeding. Disabling unused services is a foundational hardening principle that eliminates entry points an attacker cannot exploit if the service is not running.

Application-level patching targets third-party software vulnerabilities, not the OS-integrated FTP service that was exploited in this scenario.

Antivirus software inspects files for malware signatures and does not monitor or block FTP data transfers or anonymous login attempts.