6.5 Explain Exfiltration Techniques Such as DNS Tunneling, HTTPS, Email, FTP/SSH/SCP/SFTP, ICMP, Messenger, IRC, NTP, and Cloud Storage 350-701 Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A security analyst is reviewing network traffic and finds that a workstation is sending ICMP echo requests with payloads that contain what appears to be base64-encoded data. The analyst also notices DNS queries with long subdomains and NTP requests with unusual payloads. The analyst needs to determine which technique is being used for the primary exfiltration channel. Which finding would MOST strongly indicate ICMP tunneling?

   • AThe DNS queries have long subdomains
   • BThe NTP requests have unusual payloads
   • CThe ICMP echo requests have base64-encoded payloads
   • DThe workstation is sending traffic to an external IP address
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   How can NTP be abused to exfiltrate data?

   • ABy using NTP to synchronize clocks to a malicious time source
   • BBy embedding data in the NTP packet's payload or using NTP queries to a controlled server
   • CBy using NTP to resolve domain names
   • DBy using NTP to encrypt data with time-based keys
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Which security measure is most effective at preventing email-based exfiltration of sensitive data?

   • ADisabling the email server's SMTP port
   • BUsing a stronger email encryption algorithm
   • CRestricting email to internal recipients only
   • DData Loss Prevention (DLP) policies that scan email content and attachments
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which security control is specifically designed to inspect HTTPS traffic for exfiltration?

   • ATLS/SSL decryption and inspection
   • BMAC address filtering
   • CDNS sinkholing
   • DPort security
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A security analyst is reviewing firewall logs and notices a workstation maintaining a persistent connection to an external IRC server on TCP port 6667. The connection is active during off-hours, and the data transferred is not typical of a chat session. The analyst suspects IRC exfiltration. Which action would be the MOST appropriate first step to confirm the suspicion?

   • ADisable the workstation's network port
   • BCapture and analyze the IRC traffic to look for encoded or non-chat data
   • CBlock the workstation's IP address at the firewall
   • DCheck the workstation's running processes for IRC clients
   Reveal Solution Discussion Select an answer first