Which network traffic pattern is a common indicator of data exfiltration?

A server receiving routine software updates from a vendor's update server

A workstation sending a large volume of data to an external IP address during off-hours

A firewall blocking an inbound connection attempt from an unknown IP

A user browsing a corporate intranet page during business hours

A security team discovers that a server has been exfiltrating data via DNS tunneling for several weeks. The server is critical to production and cannot be taken offline. The team has identified the domain used for tunneling and has a DLP solution that can inspect DNS queries. Which response strategy best balances containment, evidence preservation, and business continuity?

Disable the server's network interface and take a forensic image

Notify the domain registrar and request the domain be suspended

Immediately block all outbound DNS traffic from the server and rebuild the server from a known-good image

Sinkhole the malicious domain at the DNS server, capture full packet captures of the server's DNS traffic, and continue monitoring for other exfiltration channels

A company handles sensitive customer data and wants to prevent employees from copying it to USB drives. They also want to detect if large amounts of data are being sent to personal webmail. Which combination of controls best addresses both requirements?

Implement a SIEM to collect logs and alert on unusual file access patterns

Disable USB ports via group policy and deploy a DLP solution that monitors outbound email and web uploads

Encrypt all data at rest and require multi-factor authentication for email access

Use a firewall to block all outbound traffic except to approved business partners

An incident response team has identified that an attacker exfiltrated data via a compromised email account. The attacker used the account to send emails with attachments to an external address. The team has disabled the account. What should the team do next to mitigate further loss?

Delete all emails in the compromised account's sent folder

Review the email server logs to identify all emails sent from the compromised account and determine the scope of the exfiltration

Notify all employees to change their passwords

Block the external address at the email gateway

A security analyst notices a workstation sending periodic DNS queries to a rarely used domain, each query encoding a small chunk of data in the subdomain label. The data appears to be compressed and base64-encoded. Which two controls would be most effective to detect and prevent this specific exfiltration technique?

Enable DNS over HTTPS (DoH) on all clients and monitor TLS certificate transparency logs

Configure the firewall to block all UDP port 53 traffic and allow only TCP port 53 to the corporate DNS server

Deploy a DNS sinkhole for the domain and enable DNS query logging with anomaly detection

Block all outbound DNS traffic except to the corporate DNS server and enforce DNSSEC

GIAC Defending Advanced Threats

Domain 4Objective 1

Data Exfiltration GDAT Practice Questions (Page 4)

Part of the Exfiltration and Emulation domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 5–8 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

4concepts

Questions 16–20

16foundation · easy
Which network traffic pattern is a common indicator of data exfiltration?
Select an answer first
17expert · hard
A security team discovers that a server has been exfiltrating data via DNS tunneling for several weeks. The server is critical to production and cannot be taken offline. The team has identified the domain used for tunneling and has a DLP solution that can inspect DNS queries. Which response strategy best balances containment, evidence preservation, and business continuity?
Select an answer first
18application · medium
A company handles sensitive customer data and wants to prevent employees from copying it to USB drives. They also want to detect if large amounts of data are being sent to personal webmail. Which combination of controls best addresses both requirements?
Select an answer first
19application · medium
An incident response team has identified that an attacker exfiltrated data via a compromised email account. The attacker used the account to send emails with attachments to an external address. The team has disabled the account. What should the team do next to mitigate further loss?
Select an answer first
20application · medium
A security analyst notices a workstation sending periodic DNS queries to a rarely used domain, each query encoding a small chunk of data in the subdomain label. The data appears to be compressed and base64-encoded. Which two controls would be most effective to detect and prevent this specific exfiltration technique?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDAT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDAT” is a trademark of its owner, used for identification only.

Data Exfiltration GDAT Practice Questions (Page 4)

Questions 16–20

Which network traffic pattern is a common indicator of data exfiltration?

A company handles sensitive customer data and wants to prevent employees from copying it to USB drives. They also want to detect if large amounts of data are being sent to personal webmail. Which combination of controls best addresses both requirements?

An incident response team has identified that an attacker exfiltrated data via a compromised email account. The attacker used the account to send emails with attachments to an external address. The team has disabled the account. What should the team do next to mitigate further loss?

Keep studying — Exfiltration and Emulation