Steganography and Data Hiding Techniques DFE Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which of the following is a recognized type of steganography?

   • AHardware steganography
   • BFirmware steganography
   • CNetwork steganography
   • DDatabase steganography
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A forensic examiner is analyzing a set of images that may contain hidden data. The examiner has limited time and must prioritize which images to analyze first. The images include a high-resolution photo, a low-resolution logo, and a screenshot of a text document. Which image is most likely to contain hidden data, and why?

   • AAll images equally, because steganography can be used in any image.
   • BThe high-resolution photo, because it has more pixels to hide data in and is less likely to show visible artifacts.
   • CThe low-resolution logo, because it is simpler and easier to hide data in.
   • DThe screenshot of a text document, because text is easier to hide in.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A network forensic analyst is reviewing a packet capture and notices that TCP packets have unusual values in the header fields, such as the sequence number and window size. The analyst suspects network steganography. Which approach is most effective to confirm the hidden data?

   • ACompare the packet capture to a known baseline using hash comparison.
   • BUse Stegdetect to analyze the packet capture.
   • CSearch the packet payloads for plaintext strings.
   • DAnalyze the packet headers for patterns that deviate from normal traffic.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is slack space in the context of file system steganography?

   • AThe space occupied by deleted files that has not been overwritten
   • BThe unused space between the end of a file and the end of the last allocated cluster
   • CThe space reserved for the file system's boot sector
   • DThe space in a file's header that is not used by metadata
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A network administrator discovers that an employee has been sending WAV audio files to an external party. The files sound like normal music but are slightly larger than expected. The administrator suspects data exfiltration. Which technique is most likely being used, and what should the administrator do to confirm?

   • ALSB insertion; compare the file size to the original to detect extra data.
   • BWhitespace manipulation; view the file in a text editor to see extra spaces.
   • CEcho hiding; analyze the audio for artificial echo patterns using spectral analysis.
   • DSpread spectrum; check the file's metadata for unusual comments.
   Reveal Solution Discussion Select an answer first