CISSP Communication and Network Security Practice Question
Which of the following is a secure protocol for transferring files that uses SSH for authentication and encryption?
⚠ Common exam trap
Many exam-takers confuse SFTP with FTPS or SCP, as both involve secure file transfer, but only SFTP is explicitly defined as a protocol that uses SSH for authentication and encryption, while SCP is a command-line tool that also uses SSH but is not a full protocol, and FTPS uses TLS/SSL instead of SSH.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SFTP
SFTP (SSH File Transfer Protocol) is the correct answer because it is a secure file transfer protocol that operates over the SSH (Secure Shell) protocol, typically on TCP port 22. It leverages SSH's strong authentication and encryption mechanisms to protect both the data in transit and the credentials, making it a secure alternative to FTP.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
FTPS
Why it's wrong here
FTPS (FTP Secure) encrypts FTP traffic using TLS/SSL, providing confidentiality and integrity for file transfers. While it is a secure protocol, it operates by wrapping the traditional FTP protocol, often requiring multiple ports for control and data channels, which can introduce firewall configuration challenges. Unlike SFTP, FTPS does not leverage the SSH protocol for its security mechanisms.
- ✗
SCP
Why it's wrong here
SCP (Secure Copy Protocol) is a secure method for transferring files between hosts, leveraging the SSH protocol for authentication and encryption. While secure and efficient for simple file transfers, SCP is primarily a file copying utility and lacks advanced features such as directory listing, remote file deletion, or resuming interrupted transfers, which are standard capabilities in more comprehensive file transfer protocols like SFTP.
- ✗
TFTP
Why it's wrong here
TFTP (Trivial File Transfer Protocol) is an extremely simple protocol designed for basic file transfers, often used for booting diskless workstations or transferring configuration files. However, TFTP offers no authentication mechanisms, nor does it provide any encryption for the data in transit. Consequently, it is highly insecure and should never be used for transferring sensitive information over untrusted networks.
- ✓
SFTP
Why this is correct
SFTP (SSH File Transfer Protocol) is a secure file transfer protocol that operates over the Secure Shell (SSH) protocol. It provides a full range of file system operations, including file transfer, remote file management (listing, deleting, renaming), and directory creation, all while ensuring strong authentication, confidentiality, and integrity through SSH's encryption and authentication mechanisms. SFTP is widely preferred for its robust security and comprehensive functionality.
Go deeper
Related to this question
Learn chapter
Asset Security: Privacy and Data Retention
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
Key term
Encryption
Encryption is the process of converting readable data into a secret code to prevent unauthorized access.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.