Which of the following statements.

Importance of Secure Protocols for Web Server Management:

Web servers handle sensitive data, including user credentials, financial information, and confidential communications.

Using secure protocols like HTTPS, SFTP, and TLS-encrypted SMTP ensures data is encrypted and protected from cyber threats.

Risks of Clear-Text Protocols (HTTP & FTP):

HTTP (Hypertext Transfer Protocol) and FTP (File Transfer Protocol) transmit data in plaintext, making them vulnerable to man-in-the-middle (MITM) attacks, packet sniffing, and unauthorized access.

SFTP (Secure File Transfer Protocol) and HTTPS (Hypertext Transfer Protocol Secure) encrypt data, mitigating these risks.

Why Other Options Are Incorrect:

A. The file transfer protocol (FTP) should always be enabled – Incorrect.

FTP is not secure, and enabling it can expose the server to unauthorized file access and cyberattacks.

B. The simple mail transfer protocol (SMTP) should be operating under the most privileged accounts – Incorrect.

SMTP should operate with minimal privileges to reduce security risks in case of a breach.

C. The number of ports and protocols allowed to access the web server should be maximized – Incorrect.

Minimizing open ports and protocols reduces the attack surface and limits unauthorized access.

IIA’s Perspective on IT Security and Web Server Management:

IIA Standard 2110 – Governance requires organizations to establish secure IT practices, including encryption and secure protocols.

IIA GTAG (Global Technology Audit Guide) on IT Risks emphasizes minimizing security vulnerabilities by using encrypted communication.

ISO 27001 Security Standard recommends secure transmission protocols for protecting sensitive data.

IIA References:

IIA Standard 2110 – IT Security and Governance

IIA GTAG – IT Risks and Secure Web Server Management

ISO 27001 Security Standard – Data Encryption and Secure Transmission

Thus, the correct and verified answer is D. Secure protocols for confidential pages should be used instead of clear-text protocols such as HTTP or FTP.