A company is using a legacy FTP server to transfer financial data to a third party. The legacy system does not support SFTP, so a compensating control is needed to protect the sensitive, financial…

Question

Options

• ATelnet connection
• BSSH tunneling
• CPatch installation
• DFull disk encryption

• A
  9% (3)
• B
  71% (25)
• C
  3% (1)
• D
  17% (6)

Explanation

SSH tunneling (B) wraps the unencrypted FTP traffic inside an encrypted SSH connection, protecting sensitive data in transit without requiring the legacy FTP server itself to support encryption - making it an ideal compensating control.

Why the others are wrong:

• A (Telnet): Telnet transmits data in plaintext, adding zero security - it would make things worse, not better.
• C (Patch installation): Patches fix software vulnerabilities but cannot add SFTP capability to a system that architecturally doesn't support it, and they don't protect data in transit.
• D (Full disk encryption): FDE protects data at rest on a disk, not data in transit across a network - wrong layer of protection.

Memory tip: Think of SSH tunneling as a secure armored pipe wrapped around an old, leaky garden hose. The hose (FTP) stays unchanged, but everything flowing through it is protected. When you see "compensating control for unencrypted transit," SSH tunnel is almost always the answer.

No community discussion yet for this question.