ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

SFTP is carried over the SSH protocol, providing encryption for both authentication data and file contents. By using key-based authentication, the client validates the server's host key while the server validates the client's public key, satisfying the requirement for mutual authentication. Because SFTP multiplexes control and data over a single SSH session on port 22, only one inbound rule is needed in the security group, simplifying firewall management.

FTPS in explicit mode encrypts traffic but requires port 21 plus a range of ephemeral data-channel ports, increasing the attack surface and firewall complexity. A plain FTP session inside an IPsec VPN would encrypt the tunnel but exposes an unencrypted FTP service if the tunnel terminates at the EC2 host, and FTP still needs multiple ports. HTTPS PUT secures data in transit but normally authenticates only the server; relying on an API key does not constitute mutual authentication. Therefore, SFTP with SSH key pairs is the most appropriate choice.