6.5 Explain Exfiltration Techniques Such as DNS Tunneling, HTTPS, Email, FTP/SSH/SCP/SFTP, ICMP, Messenger, IRC, NTP, and Cloud Storage 350-701 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security team is investigating a data breach. They find that a user has been sending sensitive data to an external recipient using a web-based email service over HTTPS. The team wants to detect this type of exfiltration. Which detection method would be MOST effective?

   • AAnalyze NetFlow records to determine the content of the emails
   • BReview the user's browser history for the web-based email service
   • CBlock all HTTPS traffic to web-based email services
   • DInspect the HTTPS traffic with a man-in-the-middle proxy
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Why might an attacker prefer SFTP over FTP for exfiltration?

   • ASFTP encrypts the data in transit, making it harder to detect
   • BSFTP uses a non-standard port that bypasses firewalls
   • CSFTP is faster than FTP, so exfiltration is quicker
   • DSFTP compresses the data to avoid detection
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A network administrator discovers that a server in the DMZ has been making outbound SSH connections to an external IP address. The connections are not part of any legitimate administrative process. The administrator suspects data is being transferred using SCP or SFTP. Which action would provide the MOST reliable evidence of the exfiltration?

   • AMonitor the server's CPU usage for spikes
   • BCapture and decrypt the SSH traffic using a network tap
   • CEnable detailed logging on the SSH server to record file transfer commands and file names
   • DBlock outbound SSH traffic from the DMZ server
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security analyst is reviewing email logs and finds that an employee has been sending emails with encrypted attachments to a personal email address. The attachments are large and the emails are sent outside of business hours. The company policy requires all email to be sent through the corporate email gateway. Which control would MOST directly prevent this type of exfiltration?

   • ARequire multi-factor authentication for the corporate email account
   • BConfigure the email gateway to block outbound emails to personal email domains
   • CImplement a data loss prevention (DLP) policy that scans email content for sensitive data
   • DEnable TLS encryption for all outbound email
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What makes messenger-based exfiltration difficult to detect?

   • AMessenger apps are only allowed on internal networks
   • BMessenger traffic is often encrypted and uses common ports like 443
   • CMessenger apps do not leave any trace on the network
   • DMessenger traffic uses a proprietary protocol that is invisible to firewalls
   Reveal Solution Discussion Select an answer first