2.9 Describe Evasion and Obfuscation Techniques, Such as Tunneling, Encryption, and Proxies 200-201 Practice Questions (Page 6)

Questions 26–27

1. 26expert · hard

   A security analyst is investigating a possible data exfiltration. The analyst sees a host making DNS queries to an external domain with long subdomains that contain base64-encoded data. The analyst also notices that the host is configured to use a public DNS-over-HTTPS (DoH) service. Which combination of techniques is the attacker using to evade detection?

   • ATunneling and proxying
   • BDNS tunneling and encryption
   • CHTTP tunneling and proxying
   • DEncryption and proxying
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A security analyst is investigating a compromised server that is sending data to an external IP address. The data is encapsulated in ICMP echo requests, but the payload is encrypted. The analyst suspects the attacker is using a combination of tunneling and encryption. Which two techniques are being combined?

   • AEncryption and encoding
   • BTunneling over ICMP and encrypting the payload
   • CProxying and encryption
   • DTunneling over DNS and encryption
   Reveal Solution Discussion Select an answer first