Data Exfiltration GDAT Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security analyst is reviewing firewall logs and sees a workstation making outbound connections to a remote IP address on port 443, but the traffic pattern is unusual: the connections are short-lived and occur every few minutes. The workstation has no business reason to connect to that IP. What should the analyst do first?

   • ACheck the workstation's process list and network connections to identify the application making the connections
   • BIgnore the traffic because it is encrypted and cannot be inspected
   • CBlock the remote IP address at the firewall
   • DRebuild the workstation from a known-good image
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company has implemented a DLP solution that monitors outbound email and web traffic. However, the security team is concerned about data exfiltration via file-sharing services that use HTTPS. What additional monitoring capability would best address this gap?

   • AIncrease the logging level on the firewall to capture all HTTPS traffic.
   • BDeploy a cloud access security broker (CASB) to monitor and control sanctioned and unsanctioned cloud apps.
   • CUse a network sniffer to capture and decrypt all HTTPS traffic.
   • DBlock all access to file-sharing services at the firewall.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   During an incident response, you discover that an attacker has been using HTTPS to a cloud storage service to upload files from a compromised server. The server is still running and the attacker may still have access. What is the most appropriate immediate response step?

   • ADisconnect the server from the network immediately and take a memory image.
   • BDelete the uploaded files from the cloud storage service.
   • CChange the server's firewall rules to block the cloud storage service's IP addresses.
   • DRebuild the server from a clean image and restore from backups.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A security analyst is investigating a potential data exfiltration incident. The network logs show that a large amount of data was transferred to an external IP over a period of several hours. However, the data was encrypted, and the analyst cannot see the content. The analyst also notices that the external IP is associated with a legitimate cloud service used by the company. What is the most appropriate next step?

   • AImmediately escalate to law enforcement.
   • BBlock the external IP address to stop the transfer.
   • CConclude that the transfer was legitimate because the cloud service is approved.
   • DCorrelate the transfer with user activity logs and data classification labels to determine if the data was sensitive.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company is implementing a data exfiltration prevention strategy. They have a mix of on-premises and cloud workloads, and they need to protect data in transit and at rest. They also need to comply with data residency requirements. Which combination of controls would best meet these needs?

   • ADisable all external network access to prevent exfiltration.
   • BUse only on-premises storage to avoid cloud data residency issues.
   • CImplement DLP only on email gateways.
   • DEncrypt all data at rest and in transit, and use a CASB to monitor cloud usage.
   Reveal Solution Discussion Select an answer first