6.5 Explain Exfiltration Techniques Such as DNS Tunneling, HTTPS, Email, FTP/SSH/SCP/SFTP, ICMP, Messenger, IRC, NTP, and Cloud Storage 350-701 Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A security team is investigating a data breach. They find that a user has been uploading files to a personal cloud storage account using HTTPS. The team wants to implement a control that prevents this exfiltration while still allowing legitimate business use of cloud storage. Which approach would BEST meet this requirement?

   • ARequire users to use a corporate-approved cloud storage service
   • BDecrypt all HTTPS traffic with a MITM proxy and inspect for sensitive data
   • CBlock all access to personal cloud storage domains at the firewall
   • DUse a CASB to enforce policies that allow sanctioned cloud services and block unsanctioned ones
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A security analyst is investigating a potential data exfiltration. The logs show a workstation maintaining a persistent connection to an IRC server. The analyst also sees DNS queries with long subdomains and ICMP echo requests with unusual payloads. The analyst needs to determine which technique is being used for the primary exfiltration channel. Which finding would MOST strongly indicate IRC exfiltration?

   • AThe DNS queries have long subdomains
   • BThe workstation is sending traffic to an external IP address
   • CThe ICMP echo requests have unusual payloads
   • DThe workstation is maintaining a persistent connection to an IRC server
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security analyst notices a workstation sending a high volume of DNS queries to a single external domain that is not a known CDN or analytics service. The queries contain long, random-looking subdomain labels, and the responses are larger than typical DNS replies. The analyst also observes the workstation sending periodic ICMP echo requests to the same external IP with payloads that vary in size and content. Which two techniques are most likely being used together for data exfiltration?

   • ADNS tunneling and ICMP tunneling
   • BHTTPS exfiltration and ICMP tunneling
   • CDNS tunneling and cloud storage upload
   • DNTP abuse and DNS tunneling
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   How can cloud storage services be used to exfiltrate data?

   • ABy using cloud storage to resolve DNS queries
   • BBy uploading sensitive files to an external cloud storage account controlled by the attacker
   • CBy using cloud storage to encrypt data with a public key
   • DBy using cloud storage to modify firewall rules
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A network administrator notices that a server is sending a large number of NTP requests to an external time server. The requests are more frequent than normal and the response packets are unusually large. The administrator suspects NTP abuse for exfiltration. Which characteristic of NTP makes it a viable exfiltration channel?

   • ANTP is always encrypted, providing confidentiality for the exfiltrated data
   • BNTP requires authentication, making it difficult to spoof
   • CNTP responses can carry a large payload in the data field, which can be used to hide data
   • DNTP uses UDP port 123, which is typically blocked by firewalls
   Reveal Solution Discussion Select an answer first