Steganography and Data Hiding Techniques DFE Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A forensic examiner is analyzing a large set of images from a suspect's computer. The examiner has limited time and needs to prioritize which images to examine manually. The examiner runs Stegdetect on all images and gets a list of images with positive detections. However, the examiner knows that Stegdetect can produce false positives. Which additional step would be most effective to confirm the presence of hidden data?

   • ACheck the file sizes of the flagged images against the original sizes
   • BPerform a visual inspection of the images flagged by Stegdetect
   • CRun a different steganalysis tool, such as OpenStego's analysis feature, on the flagged images
   • DUse a hex editor to manually examine the flagged images
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   Which tool is specifically designed for steganalysis (detecting hidden data)?

   • AWireshark
   • BOpenStego
   • CSteghide
   • DStegdetect
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A security analyst is explaining to a colleague the difference between steganography and cryptography. Which statement correctly describes the primary difference?

   • ASteganography hides the existence of the message, while cryptography scrambles the message so it cannot be read without a key
   • BCryptography hides the existence of the message, while steganography scrambles the message
   • CSteganography is always more secure than cryptography
   • DBoth steganography and cryptography are used to encrypt data
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A network forensic analyst is examining a packet capture and notices that the TCP window size values are unusual and vary in a pattern that correlates with the payload data. The analyst suspects network steganography. Which technique is most likely being used, and what is the best way to confirm it?

   • APayload encoding; decode the payload using base64.
   • BHeader field manipulation; analyze the window size values across packets to extract the hidden data.
   • CPacket timing; measure the inter-arrival times of packets.
   • DProtocol switching; use a different protocol like ICMP.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A network administrator notices unusual traffic patterns on a corporate network. Packets are being sent at regular intervals, but the timing between packets varies slightly in a way that seems to encode information. The payloads themselves appear normal. Which steganographic technique is being used?

   • AImage LSB insertion
   • BText whitespace manipulation
   • CAudio echo hiding
   • DNetwork steganography via packet timing
   Reveal Solution Discussion Select an answer first