Which of the following ports and protocol types must be opened on a host with a host- based firewall to allow incoming SFTP connections?

Port 21 belongs to traditional FTP (not SFTP), and UDP does not provide the reliable delivery required by SSH or any file transfer protocol.

Port 21 is the FTP control port used by traditional unencrypted FTP; SFTP is an entirely different protocol that does not use port 21 under any configuration.

While SSH uses port 22, it operates over TCP, not UDP; SSH requires TCP's guaranteed ordered delivery to function correctly and does not support UDP.

SFTP is not a variant of FTP but rather a file transfer protocol built on top of the SSH-2 protocol, which operates exclusively on TCP port 22. TCP is required because SSH - and by extension SFTP - needs the reliable, ordered, connection-oriented delivery that TCP provides to ensure data integrity during file transfer. Opening TCP port 22 on a host-based firewall is sufficient to allow incoming SFTP sessions.