If an FTP server allows guest login, what risk is most likely?

If an FTP server allows guest login, what risk is most likely?

• A. Anonymous access can lead to data exposure
• B. FTP servers with anonymous access provide strong authentication
• C. FTP servers expose guest logins enabling directory listing and file download
• D. FTP servers automatically encrypt credentials

Answer: (C)

Allowing guest login on an FTP server means anyone can connect without credentials, and these servers often expose a public area where files can be listed and downloaded. The most likely risk is that a guest account can enumerate the directory structure and fetch files, which can lead to exposure of sensitive documents, configuration files, or software that shouldn’t be publicly accessible. This makes it easy for an attacker to discover what’s available and copy it without needing an actual user account. This explanation is more precise than saying anonymous access simply leads to data exposure, because it points to the specific mechanism: directory listing and file download by an unauthenticated user. It’s not about strong authentication, which anonymous access does not provide, and standard FTP doesn’t inherently encrypt credentials—encryption would require FTPS or SFTP, which are separate measures. To reduce risk, disable anonymous access or tightly restrict what anonymous users can see and download, and prefer authenticated access with proper permissions, plus logging and monitoring.

Allowing guest login on an FTP server means anyone can connect without credentials, and these servers often expose a public area where files can be listed and downloaded. The most likely risk is that a guest account can enumerate the directory structure and fetch files, which can lead to exposure of sensitive documents, configuration files, or software that shouldn’t be publicly accessible. This makes it easy for an attacker to discover what’s available and copy it without needing an actual user account.

This explanation is more precise than saying anonymous access simply leads to data exposure, because it points to the specific mechanism: directory listing and file download by an unauthenticated user. It’s not about strong authentication, which anonymous access does not provide, and standard FTP doesn’t inherently encrypt credentials—encryption would require FTPS or SFTP, which are separate measures. To reduce risk, disable anonymous access or tightly restrict what anonymous users can see and download, and prefer authenticated access with proper permissions, plus logging and monitoring.