2.9 Describe Evasion and Obfuscation Techniques, Such as Tunneling, Encryption, and Proxies 200-201 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   How does encryption help attackers evade security monitoring?

   • AIt makes the traffic invisible to network devices.
   • BIt allows traffic to bypass firewall rules.
   • CIt hides the content of the traffic from inspection tools.
   • DIt prevents security devices from seeing the source and destination IP addresses.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which statement best describes how tunneling is used as an evasion technique in network security?

   • AIt fragments packets so that security devices cannot reassemble the original data.
   • BIt encrypts the payload of a packet so that security devices cannot read it.
   • CIt replaces the original protocol with a different protocol to avoid detection.
   • DIt encapsulates one protocol inside another to hide the true nature of the traffic.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security analyst is investigating a malware infection. The malware is communicating with a command-and-control (C2) server using HTTPS, but the analyst cannot determine the C2 server's IP address because the traffic is routed through a series of anonymous proxies. Which two evasion techniques are being used?

   • ATunneling and encryption
   • BEncryption and tunneling
   • CProxy chaining and tunneling
   • DEncryption and proxy chaining
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An analyst is investigating a series of attacks that appear to originate from a single IP address. However, the analyst notices that the source IP changes frequently and the traffic patterns suggest the attacker is using an intermediary to hide the true origin. Which technique is the attacker most likely using?

   • AUsing DNS to resolve the attacker's true IP
   • BA proxy server to relay the attack traffic
   • CTunneling the attack traffic through a VPN
   • DEncrypting the attack traffic to hide the payload
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security analyst notices that a compromised host inside the corporate network is sending continuous ICMP echo requests to an external server. The payload of these packets contains what appears to be base64-encoded data. The analyst suspects the host is using ICMP as a covert channel. Which technique is the attacker most likely using?

   • AUsing a proxy to relay the ICMP traffic through an intermediate server
   • BEncrypting the ICMP payload with a symmetric cipher to hide the data
   • CUsing DNS to resolve a domain that returns the exfiltrated data
   • DTunneling a protocol such as HTTP over ICMP
   Reveal Solution Discussion Select an answer first