mediumMultiple Choice
ISC2 CC Practice Question: A company uses a proxy server for internet access
A company uses a proxy server for internet access. Employees can browse websites (HTTP/HTTPS), but they cannot connect to external FTP servers using FTP client software (e.g., FileZilla). The proxy is configured to allow HTTP and HTTPS only. The security team wants to allow FTP while maintaining security (e.g., logging and filtering). The FTP traffic is used for occasional file transfers with partners. Which of the following is the BEST solution to meet both requirements?
⚠ Common exam trap
ISC2 often tests the misconception that a standard HTTP/HTTPS proxy can be extended to handle FTP by simply enabling a setting, when in reality FTP requires a separate application-layer proxy due to its distinct control/data channel architecture and protocol semantics.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Install a separate FTP proxy in the DMZ and adjust firewall rules to allow FTP traffic to that proxy.
Deploying a dedicated FTP proxy in the DMZ allows the security team to inspect, log, and filter FTP traffic while keeping the existing HTTP/HTTPS proxy unchanged. Firewall rules can be tightened to permit FTP only to that proxy, which then forwards connections to external FTP servers, maintaining a secure, auditable chokepoint without exposing internal clients directly to FTP.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Install a separate FTP proxy in the DMZ and adjust firewall rules to allow FTP traffic to that proxy.
Why this is correct
An FTP proxy in the DMZ terminates FTP sessions, letting the existing HTTP/HTTPS-only proxy remain unchanged while the firewall permits FTP solely to that proxy. This preserves logging and content filtering for partner transfers, satisfying the requirement to allow FTP without exposing internal hosts directly.
- ✗
Use SSH tunneling to encapsulate FTP traffic over SSH to a jump server.
Why it's wrong here
SSH tunnelling encrypts FTP end-to-end, so the proxy cannot inspect, log or filter the file transfers, failing the security requirement. It is tempting because tunnelling bypasses protocol restrictions cleanly, and would be correct for securing FTP over untrusted networks, not for proxy-mediated visibility.
- ✗
Configure the proxy to allow FTP traffic by adding FTP as an allowed protocol.
Why it's wrong here
Adding FTP as an allowed protocol requires the proxy to handle FTP's separate control and data channels, which HTTP/HTTPS proxies do not natively inspect, so filtering and logging are not achieved. It is tempting as the obvious configuration change, and would be correct only for a proxy with a dedicated FTP gateway.
- ✗
Enable FTP passive mode on the proxy.
Why it's wrong here
Passive mode only changes which side opens the data connection; it does not make the HTTP/HTTPS proxy understand or log FTP commands and payloads. It is tempting because passive mode solves many firewall traversal problems, and would be correct when a firewall blocks active-mode data channels, not for proxy inspection.
Visual reference
Go deeper
Related to this question
Learn chapter
Secure Network Architecture and Design
Key term
Hypertext Transfer Protocol Secure
Hypertext Transfer Protocol Secure, or HTTPS, is the secure version of HTTP that encrypts data between a web browser and a website using SSL/TLS to protect sensitive information like passwords and credit card numbers.
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
About these practice questions
Courseiva writes every CC question from scratch — 989 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.