mediumMultiple ChoiceObjective-mapped
ISC2 CC Practice Question: A company uses a proxy server for internet access
A company uses a proxy server for internet access. Employees can browse websites (HTTP/HTTPS), but they cannot connect to external FTP servers using FTP client software (e.g., FileZilla). The proxy is configured to allow HTTP and HTTPS only. The security team wants to allow FTP while maintaining security (e.g., logging and filtering). The FTP traffic is used for occasional file transfers with partners. Which of the following is the BEST solution to meet both requirements?
⚠ Common exam trap
ISC2 often tests the misconception that a standard HTTP/HTTPS proxy can be extended to handle FTP by simply enabling a setting, when in reality FTP requires a separate application-layer proxy due to its distinct control/data channel architecture and protocol semantics.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Install a separate FTP proxy in the DMZ and adjust firewall rules to allow FTP traffic to that proxy.
Deploying a dedicated FTP proxy in the DMZ allows the security team to inspect, log, and filter FTP traffic while keeping the existing HTTP/HTTPS proxy unchanged. Firewall rules can be tightened to permit FTP only to that proxy, which then forwards connections to external FTP servers, maintaining a secure, auditable chokepoint without exposing internal clients directly to FTP.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Install a separate FTP proxy in the DMZ and adjust firewall rules to allow FTP traffic to that proxy.
Why this is correct
An FTP proxy can inspect and log FTP traffic, and being in the DMZ adds security; firewall rules can restrict access.
- ✗
Use SSH tunneling to encapsulate FTP traffic over SSH to a jump server.
Why it's wrong here
This bypasses proxy controls and does not provide logging at the proxy level; also adds complexity.
- ✗
Configure the proxy to allow FTP traffic by adding FTP as an allowed protocol.
Why it's wrong here
FTP is an insecure protocol and the proxy may not properly inspect it; also, FTP over proxy can be problematic.
- ✗
Enable FTP passive mode on the proxy.
Why it's wrong here
Passive mode is a client configuration, not a proxy setting; the proxy must still support FTP.
Visual reference
Go deeper
Related to this question
Learn chapter
Introduction to Security Principles
Key term
Hypertext Transfer Protocol Secure
Hypertext Transfer Protocol Secure, or HTTPS, is the secure version of HTTP that encrypts data between a web browser and a website using SSL/TLS to protect sensitive information like passwords and credit card numbers.
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
About these practice questions
Courseiva writes every CC question from scratch — 976 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.