ISC2 CC Network Security Practice Question
Which protocol is considered insecure because it transmits data in cleartext, including passwords?
⚠ Common exam trap
Test-takers frequently confuse 'file transfer' protocols with 'remote login' protocols — candidates may pick SFTP thinking it is insecure because it sounds like FTP, when in fact SFTP is encrypted and FTP is the cleartext one.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Telnet
Telnet is considered insecure because it transmits all data — including usernames and passwords — in cleartext over the network, with no encryption whatsoever. Anyone with access to the traffic path (via packet capture or MITM) can read credentials directly. This is why Telnet has been replaced by SSH for remote administration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SFTP
Why it's wrong here
SFTP runs over SSH, encrypting credentials and file data in transit, so it does not transmit cleartext passwords. It tempts because the similar-sounding FTP sends everything unencrypted, but SFTP is the secured variant and therefore fails the insecure criterion.
- ✗
SSH
Why it's wrong here
SSH encrypts the entire session, including authentication, so passwords never traverse the network in cleartext. It tempts because SSH replaced insecure cleartext tools like Telnet and rlogin, but SSH itself is the secure successor, not the vulnerable protocol the question targets.
- ✗
HTTPS
Why it's wrong here
HTTPS encrypts traffic using TLS, so credentials and data are not sent in cleartext, failing the insecure criterion. It tempts because its predecessor HTTP is cleartext, and misconfigured TLS or mixed content can leak data, but the protocol itself provides encryption.
- ✓
Telnet
Why this is correct
Telnet transmits all session data, including login credentials, as unencrypted cleartext across the network, so anyone capturing traffic can read passwords directly. This satisfies the stem's constraint of a protocol deemed insecure precisely because it lacks encryption, unlike SSH, which tunnels the same terminal access within an encrypted channel.
Go deeper
Related to this question
Learn chapter
Network Security Components and Controls
Key term
SSH
SSH (Secure Shell) is a cryptographic network protocol that provides secure, encrypted communication and remote administration between two devices over an unsecured network.
Key term
Telnet
Telnet is a network protocol that provides a bidirectional, interactive text-based communication session between two machines over a network, typically used for remote access and management of network devices.
About these practice questions
This CC question is part of Courseiva's 989-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.