6.5 Explain Exfiltration Techniques Such as DNS Tunneling, HTTPS, Email, FTP/SSH/SCP/SFTP, ICMP, Messenger, IRC, NTP, and Cloud Storage 350-701 Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A company's security team is investigating a data leak. They find that an employee has been using a personal instant messaging application on a corporate workstation to send files to an external recipient. The IM traffic is encrypted. Which detection method would be MOST effective in identifying this exfiltration?

   • ABlock all outbound traffic on the workstation
   • BInspect the IM traffic with a man-in-the-middle proxy
   • CMonitor the employee's keyboard activity
   • DUse a next-generation firewall (NGFW) with application identification to detect and block the IM application
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Why is NTP a potential exfiltration vector that may go unnoticed?

   • ABecause NTP traffic is often allowed outbound and is not typically inspected for data content
   • BBecause NTP is encrypted and cannot be read
   • CBecause NTP uses port 443, which is always open
   • DBecause NTP is only used internally and never leaves the network
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Why is ICMP often allowed through firewalls, making it a viable exfiltration channel?

   • ABecause ICMP is used for network troubleshooting and diagnostics
   • BBecause ICMP is encrypted and cannot be inspected
   • CBecause ICMP is only used for internal traffic
   • DBecause ICMP uses port 443, which is commonly open
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A security analyst is investigating a potential data exfiltration. The firewall logs show a workstation sending a high volume of DNS queries to a domain that is not on any allowlist. The queries have long, random subdomains. The analyst also sees ICMP echo requests with varying payload sizes and NTP requests to an external server. The analyst needs to determine which technique is being used for the primary exfiltration channel. Which observation would MOST strongly indicate DNS tunneling over ICMP or NTP tunneling?

   • AThe NTP requests are sent to an external server
   • BThe DNS queries have long, random subdomains that encode data
   • CThe ICMP echo requests have varying payload sizes
   • DThe DNS queries are sent to a domain that is not on any allowlist
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A security team is investigating a data breach where sensitive files were uploaded to an external cloud storage service. The uploads were done using the service's web interface over HTTPS. Which control would be MOST effective in preventing this type of exfiltration?

   • ABlock all HTTPS traffic to external websites
   • BDisable the web interface of the cloud storage service
   • CRequire multi-factor authentication for all corporate accounts
   • DUse a cloud access security broker (CASB) to control access to sanctioned and unsanctioned cloud services
   Reveal Solution Discussion Select an answer first