Question

which of the following is a limitation of active ftp mode regarding firewalls?

a it encrypts the data transfer by default.
b it requires https for data transfer.
c it only works with tcp port 22.
d it can cause configuration problems due to unpredictable port usage.

Explanation:

Analyze active FTP connection mechanics

In active FTP mode, the client initiates a control connection from a random high port to the FTP server's port 21. When data transfer is required, the client sends a PORT command specifying a random high port on which it is listening. The server then initiates the data connection from its port 20 back to this client-specified port.

Evaluate firewall implications

Because the server initiates the inbound connection to a random, unpredictable high port on the client side, client-side firewalls typically block this unsolicited incoming traffic. This requires complex firewall configurations (such as stateful inspection or application-level gateways) to track the dynamic port negotiation, leading to configuration issues.

Assess the given options

• Option A: Incorrect. Standard FTP does not encrypt data by default.
• Option B: Incorrect. FTP does not use HTTPS.
• Option C: Incorrect. FTP uses ports 20 and 21, while port 22 is for SSH/SFTP.
• Option D: Correct. The dynamic, unpredictable inbound port usage causes firewall configuration issues.

Answer:

• (A) It encrypts the data transfer by default.
• (B) It requires HTTPS for data transfer.
• (C) It only works with TCP port 22.
• (D) It can cause configuration problems due to unpredictable port usage. (Correct answer)