CISSP Communication and Network Security Practice Question
A company wants to securely transfer files between systems over SSH. Which protocol should they use to leverage the existing SSH infrastructure and provide both authentication and encryption?
⚠ Common exam trap
A common mix-up: candidates confuse SFTP with FTPS or SCP, as many candidates assume 'SSH' implies SCP is the only option, but SFTP is the modern, feature-rich protocol that fully leverages SSH infrastructure for secure file transfers.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SFTP
SFTP (SSH File Transfer Protocol) is the correct choice because it operates over the SSH protocol (typically port 22), leveraging its existing authentication and encryption mechanisms. Unlike FTPS, which adds SSL/TLS to FTP, SFTP is designed as a secure file transfer subsystem of SSH, providing both confidentiality and integrity without requiring additional infrastructure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
FTPS
Why it's wrong here
FTPS (FTP Secure) encrypts FTP traffic using SSL/TLS, operating in either explicit (AUTH TLS) or implicit (port 990) modes. While it provides confidentiality and integrity, it often requires opening multiple ports for data channels (especially in passive mode), which complicates firewall configurations and can be challenging to manage securely. This multi-channel approach makes it less streamlined than SSH-based solutions for secure file transfers.
- ✓
SFTP
Why this is correct
SFTP (SSH File Transfer Protocol) is the correct choice because it runs as a subsystem over a single SSH connection, leveraging SSH's robust authentication and encryption capabilities. This provides strong security for both data in transit and control commands, operating efficiently over a single port (typically 22) which simplifies firewall management. SFTP also offers a rich set of features, including directory listings, file deletion, and resume capabilities, making it a comprehensive solution for secure file management.
- ✗
TFTP
Why it's wrong here
TFTP (Trivial File Transfer Protocol) is fundamentally insecure as it uses UDP and lacks any built-in security mechanisms for authentication, authorization, or encryption. Its primary design goal is simplicity and speed for small, non-critical file transfers, such as network booting or firmware upgrades, rather than secure data exchange. Therefore, it is entirely unsuitable for transferring sensitive files between systems.
- ✗
SCP
Why it's wrong here
SCP (Secure Copy Protocol) utilizes SSH for secure data transfer, providing strong encryption and authentication for file copying. However, SCP is limited to basic file transfer operations, primarily copying files between hosts. It lacks advanced features such as directory listing, file deletion, or the ability to resume interrupted transfers, which are often necessary for comprehensive file management tasks. While secure, its limited functionality makes SFTP a more versatile and preferred option.
Go deeper
Related to this question
Learn chapter
Secure Network Architecture and Components
Key term
Encryption
Encryption is the process of converting readable data into a secret code to prevent unauthorized access.
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.