A company is using a legacy FTP server to transfer financial data to a third party. The legacy system does not support SFTP, so a compensating control is needed to protect the sensitive, financial data in transit. Which of the following would be the most appropriate for the company to use?
Choose an answer
Tap an option to check your answer.
Correct answer: SSH tunneling.
Why this is the answer
SSH tunneling is the most appropriate compensating control because it encrypts the FTP traffic, securing the financial data in transit even though the legacy FTP server itself doesn't support SFTP. This creates a secure channel over an insecure network. Telnet is incorrect because it is an unencrypted protocol and offers no protection for sensitive data. Patch installation is a good security practice but does not directly encrypt data in transit for an existing FTP connection. Full disk encryption protects data at rest, not data in transit, making it unsuitable for this specific problem.
Pass your exam — without the endless answer hunt
Get every verified question and explanation for this exam in one place, and save hours of prep. 1,000+ certifications · 20+ languages · free to start.
Pass your exam faster → No card needed