6.5 Explain Exfiltration Techniques Such as DNS Tunneling, HTTPS, Email, FTP/SSH/SCP/SFTP, ICMP, Messenger, IRC, NTP, and Cloud Storage 350-701 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What makes DNS tunneling an attractive exfiltration method for attackers?

   • ADNS traffic is often allowed through firewalls and is rarely inspected
   • BDNS uses TCP port 443, which is commonly open in firewalls
   • CDNS servers provide high bandwidth for transferring large files
   • DDNS packets are always encrypted, hiding the data from security tools
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following protocols is commonly used for file transfer and can be abused to exfiltrate data?

   • AFTP
   • BDHCP
   • CSNMP
   • DHTTP
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company's security team is investigating a potential data breach. They notice that a user's workstation has been making continuous HTTPS connections to a personal cloud storage service's API endpoint, and the traffic volume is unusually high during off-hours. The user has no business need for this service. The security team suspects data is being uploaded. Which detection method would be MOST effective in confirming this exfiltration?

   • AAnalyze NetFlow records to determine the exact file names being uploaded
   • BBlock all traffic to the cloud storage service's IP addresses
   • CInspect the TLS-encrypted payloads using a man-in-the-middle proxy with a trusted certificate
   • DReview the user's browser history for the cloud storage service
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   How does HTTPS exfiltration hide data from network security monitoring?

   • ABy sending data in the clear but labeling it as HTTPS
   • BBy encrypting the data within the TLS session, making it unreadable to passive inspection
   • CBy compressing the data so it is too small to be detected
   • DBy using a non-standard port that bypasses firewall rules
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What makes cloud storage exfiltration difficult to detect?

   • ACloud storage services do not leave any trace on the network
   • BCloud storage services are only accessible from within the corporate network
   • CCloud storage services use a proprietary protocol that is invisible to firewalls
   • DCloud storage traffic is often encrypted and uses standard web ports, blending in with normal HTTPS
   Reveal Solution Discussion Select an answer first