nerdexam
CompTIA

SY0-501 · Question #90

A security analyst wishes to increase the security of an FTP server. Currently, all trails to the FTP server is unencrypted. Users connecting to the FTP server use a variety of modem FTP client…

The correct answer is C. Use explicit FTPS for the connections. To add encryption to an FTP server while preserving the standard port and protocol and allowing optional unencrypted connections, explicit FTPS is the most suitable solution.

Submitted by chen.hong· Mar 4, 2026Security architecture

Question

A security analyst wishes to increase the security of an FTP server. Currently, all trails to the FTP server is unencrypted. Users connecting to the FTP server use a variety of modem FTP client software. The security analyst wants to keep the same port and protocol, while also still allowing unencrypted connections. Which of the following would BEST accomplish these goals?

Options

  • ARequire the SFTP protocol to connect to the file server.
  • BUse implicit TLS on the FTP server.
  • CUse explicit FTPS for the connections.
  • DUse SSH tunneling to encrypt the FTP traffic.

How the community answered

(61 responses)
  • A
    3% (2)
  • B
    16% (10)
  • C
    72% (44)
  • D
    8% (5)

Why each option

To add encryption to an FTP server while preserving the standard port and protocol and allowing optional unencrypted connections, explicit FTPS is the most suitable solution.

ARequire the SFTP protocol to connect to the file server.

Requiring SFTP changes the underlying protocol from FTP to SSH File Transfer Protocol, which typically uses a different port (e.g., 22) and is always encrypted, thus not keeping the same protocol or allowing unencrypted connections.

BUse implicit TLS on the FTP server.

Implicit FTPS immediately initiates an SSL/TLS handshake upon connection, typically requiring a separate, dedicated port (e.g., 990) and therefore does not allow unencrypted connections to the same service on the standard FTP port.

CUse explicit FTPS for the connections.Correct

Explicit FTPS (FTPES) enables clients to connect to the standard FTP control port (typically 21) and then explicitly initiate a TLS (Transport Layer Security) handshake via commands like AUTH TLS. This encrypts the data transfer using the existing FTP protocol and port. Since the TLS negotiation is optional and client-initiated, clients that do not request TLS can still connect unencrypted, fulfilling all specified requirements.

DUse SSH tunneling to encrypt the FTP traffic.

SSH tunneling encrypts traffic by encapsulating it within an SSH tunnel, which is a client-side configuration rather than a server-side FTP protocol enhancement, and it does not natively allow for both encrypted and unencrypted connections to the same FTP server instance on its standard port.

Concept tested: FTP server security with explicit FTPS

Source: https://learn.microsoft.com/en-us/iis/get-started/whats-new-in-iis-7/configure-ftp-ssl-in-iis-7

Topics

#FTPS#explicit TLS#FTP security#encryption protocols

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SY0-501 Practice