Data Exfiltration GDAT Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which action is essential for preserving evidence during a data exfiltration response?

   • AEncrypting all logs and storing them offsite
   • BCreating a forensic image of affected systems
   • CRunning antivirus scans to clean the system
   • DPowering off systems immediately without capturing memory
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security analyst is reviewing network logs and notices a series of HTTP POST requests from an internal server to an external IP address. The POST bodies are unusually large and occur at regular intervals. The server is not supposed to communicate with that IP. What does this pattern most likely indicate?

   • AA misconfigured web server responding to requests.
   • BData exfiltration via HTTP tunneling.
   • CA distributed denial-of-service (DDoS) attack.
   • DA normal software update process.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   An incident response team is handling a data exfiltration incident where the attacker used a previously unknown malware variant. The team has identified the command-and-control (C2) server and has the ability to block it. However, blocking the C2 server may alert the attacker and cause them to destroy evidence on compromised systems. What is the best approach?

   • AImmediately rebuild all compromised systems from clean images.
   • BDo not block the C2 server; instead, monitor the traffic to gather more intelligence.
   • CBlock the C2 server immediately to stop the exfiltration.
   • DDisconnect all compromised systems from the network.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A security analyst is reviewing network traffic and notices that a server is sending a large amount of data to an external IP using a protocol that is normally used for network management. The traffic is occurring at regular intervals and the data size is consistent. The server is not supposed to send data to that IP. What is the most likely explanation?

   • AThe server is compromised and using the network management protocol as a covert channel to exfiltrate data.
   • BThe server is performing a legitimate backup to an external site.
   • CThe server is experiencing a network misconfiguration.
   • DThe server is sending health checks to a monitoring service.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security analyst sees a workstation sending HTTP POST requests to a website that hosts images. The POST requests contain image files, but the images appear to have slightly altered pixel data. The analyst suspects steganography. Which detection method would be most effective?

   • AMonitor DNS query logs for unusual domain names
   • BBlock all HTTP POST requests to image-hosting websites
   • CUse a steganography detection tool that analyzes image file statistics and compares them to known clean images
   • DCheck the workstation's USB device history
   Reveal Solution Discussion Select an answer first