Steganography and Data Hiding Techniques DFE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which network steganography technique involves altering the timing of packets to encode information?

   • AEcho hiding
   • BPacket timing
   • CLSB insertion
   • DWhitespace manipulation
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security analyst notices that a server is sending ICMP packets with unusual payload sizes and irregular timing to an external IP. The packets appear to be part of a legitimate ping sweep, but the analyst suspects covert communication. Which steganographic technique is being used, and what should the analyst do to confirm?

   • AText steganography in the ICMP payload; use a hex editor to search for hidden text.
   • BImage steganography in the ICMP headers; use Stegdetect to analyze the packets.
   • CNetwork steganography in the ICMP payload and timing; capture and analyze the packets for hidden patterns.
   • DAudio steganography in the ICMP packets; use spectral analysis to detect hidden data.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is a key ethical consideration when using steganography in cybersecurity?

   • AIt is always legal to use steganography for any purpose.
   • BIt is only used by hackers and is never appropriate in professional settings.
   • CIt is a form of encryption and therefore always secure.
   • DIt can be used for legitimate purposes like digital watermarking, but also for malicious activities.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A forensic examiner needs to extract hidden data from a JPEG image that was created with Steghide. Which tool should the examiner use?

   • AOpenStego with the extract command.
   • BStegdetect with the extract command.
   • CSteghide with the extract command and the correct passphrase.
   • DWireshark to analyze the JPEG file.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A forensic examiner is analyzing a file system image. The examiner notices that some files have slack space that contains non-zero data, which is unusual. The examiner also finds a text file with trailing spaces. Which two techniques should the examiner investigate?

   • ASlack space steganography and whitespace manipulation.
   • BMasking and spread spectrum.
   • CNetwork steganography and packet timing.
   • DLSB insertion and echo hiding.
   Reveal Solution Discussion Select an answer first