ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

SFTP runs as a subsystem of the Secure Shell (SSH) protocol, so it supplies confidentiality, integrity, and client-and-server authentication over a single well-known TCP port (22). That fulfills HIPAA's requirement to protect sensitive data in transit while letting the partner expose just one port. FTPS- even in explicit TLS mode- still needs additional ephemeral data-channel ports besides TCP 21, complicating firewall rules. TFTP offers no native encryption or authentication, and adding custom encryption would still lack strong identity validation. Encapsulating plain FTP in a GRE tunnel that is then protected by IPsec would secure the payload, but the solution forces the firewall to permit IPsec ESP (protocol 50) and IKE (UDP 500/4500), exceeding the single-port constraint and adding unnecessary complexity. Therefore, SFTP over SSH is the most appropriate choice.