How can an attacker use email to exfiltrate sensitive data from a corporate network?

By sending an email to a local user and then deleting it

By embedding data in the email server's SMTP banner

By sending the data as an attachment or in the body of an email to an external address

By using email to request a DNS lookup for the data

Which technique is used by DNS tunneling to exfiltrate data from a network?

Encrypting data and sending it through the DNS root servers

Encoding data in the payload of DNS query and response packets

Using DNS to resolve IP addresses for a covert VPN connection

Sending large files as DNS zone transfer requests

How can IRC be used as a covert channel for data exfiltration?

By using IRC to resolve DNS names for data

By sending data as messages in IRC channels to a bot or user

By using IRC to encrypt all network traffic

By using IRC to modify network routing tables

A security analyst is reviewing network traffic and finds that a server is sending NTP requests to an external time server. The requests are more frequent than normal, and the response packets are larger than expected. The analyst also sees DNS queries with long subdomains and ICMP echo requests with unusual payloads. The analyst needs to determine which technique is being used for the primary exfiltration channel. Which finding would MOST strongly indicate NTP abuse?

The NTP response packets are larger than expected

The server is sending NTP requests to an external time server

The DNS queries have long subdomains

The ICMP echo requests have unusual payloads

How can ICMP packets be used to exfiltrate data?

By using ICMP to redirect traffic to an external server

By sending ICMP packets with a spoofed source IP address

By embedding data in the payload of ICMP echo request/reply packets

By using ICMP to request a DNS lookup for the data

CiscoCertified Network Professional Security

Domain 6Objective 5

SFTP, ICMP, Messenger, IRC, NTP, and Cloud Storage 350-701 Practice Questions (Page 4)

Part of the Network Access, Visibility, and Enforcement domain, which accounts for 15% of the 350-701 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–2 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

9concepts

15%of the exam

Questions 16–20

16foundation · easy
How can an attacker use email to exfiltrate sensitive data from a corporate network?
Select an answer first
17foundation · easy
Which technique is used by DNS tunneling to exfiltrate data from a network?
Select an answer first
18foundation · easy
How can IRC be used as a covert channel for data exfiltration?
Select an answer first
19expert · hard
A security analyst is reviewing network traffic and finds that a server is sending NTP requests to an external time server. The requests are more frequent than normal, and the response packets are larger than expected. The analyst also sees DNS queries with long subdomains and ICMP echo requests with unusual payloads. The analyst needs to determine which technique is being used for the primary exfiltration channel. Which finding would MOST strongly indicate NTP abuse?
Select an answer first
20foundation · easy
How can ICMP packets be used to exfiltrate data?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-701

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-701” is a trademark of its owner, used for identification only.