6.5 Explain Exfiltration Techniques Such as DNS Tunneling, HTTPS, Email, FTP/SSH/SCP/SFTP, ICMP, Messenger, IRC, NTP, and Cloud Storage 350-701 Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A security team is investigating a data leak. They find that an employee has been using a personal messaging app on a corporate laptop to send files to an external recipient. The messaging app uses end-to-end encryption. The team wants to prevent this exfiltration while allowing the employee to use the messaging app for legitimate business communication. Which control would BEST meet this requirement?

   • ABlock the messaging app at the firewall
   • BRequire the employee to use a corporate-approved messaging app
   • CUse an NGFW with application identification to allow the app but block file transfers
   • DDecrypt the messaging app traffic with a MITM proxy
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security analyst notices that a workstation is sending ICMP echo requests to an external server. The payload of the ICMP packets contains data that is not the standard padding. The analyst suspects ICMP tunneling. Which configuration change would MOST effectively prevent this type of exfiltration?

   • ADisable the workstation's network interface
   • BEnable ICMP inspection on the firewall to validate packet payloads
   • CBlock all outbound ICMP echo requests at the firewall
   • DChange the workstation's ICMP payload to a fixed size
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Why might an attacker choose IRC for exfiltration despite its age?

   • ABecause IRC uses port 53, which is always open
   • BBecause IRC provides high bandwidth for large file transfers
   • CBecause IRC is always encrypted by default
   • DBecause IRC traffic is often overlooked and may not be monitored
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   How can instant messaging applications be used to exfiltrate data?

   • ABy using the app to encrypt the entire network traffic
   • BBy using the app to modify firewall rules
   • CBy sending sensitive data as messages or files through the messaging service
   • DBy using the app to create a VPN tunnel
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security analyst is monitoring network traffic and notices a workstation sending DNS queries to a domain that is not on any allowlist. The queries have long, random-looking subdomains. The analyst also sees HTTPS traffic to a personal cloud storage service. Which technique is the analyst MOST likely observing?

   • ACloud storage exfiltration
   • BEmail exfiltration
   • CDNS tunneling
   • DHTTPS exfiltration
   Reveal Solution Discussion Select an answer first