Data Exfiltration GDAT Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A security analyst is investigating a potential data exfiltration incident. The analyst sees a workstation sending large amounts of data to a cloud storage service, but the traffic is encrypted and the workstation has a legitimate business need to use that service. The analyst also notices that the workstation is sending data to a second, unknown IP address on port 53. The analyst has limited time and resources. Which investigation step should the analyst prioritize?

   • AAnalyze the DNS queries to the unknown IP to determine if DNS tunneling is occurring
   • BBlock the unknown IP address at the firewall immediately
   • CDecrypt the TLS traffic to the cloud storage service to inspect the data being uploaded
   • DCheck the workstation's event logs for failed logon attempts
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security analyst notices a workstation making repeated DNS queries for subdomains of a domain that is not on any approved list. Each subdomain is a random-looking string, and the queries occur every few seconds. The workstation has no other unusual network activity. What should the analyst do first to confirm the suspected exfiltration technique?

   • ABlock the domain at the DNS firewall and close the case.
   • BCapture full packet data for the workstation and correlate the DNS queries with any outbound connections to the same domain.
   • CDisable the workstation's network adapter to stop the traffic.
   • DRebuild the workstation from a known-good image to remove the malware.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   An incident response team is responding to a data exfiltration incident. The attacker used a compromised user account to access a file share and upload files to a cloud storage service. The team has disabled the user account and is considering whether to notify the cloud storage provider. The company is concerned about legal implications and wants to preserve evidence. Which action should the team take first?

   • ADelete the cloud storage account and all uploaded files to prevent further loss
   • BNotify law enforcement before taking any other action
   • CChange the cloud storage account password to prevent the attacker from accessing it
   • DPreserve the cloud storage account data by requesting a legal hold from the provider
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security analyst notices that a server is sending outbound traffic to a known file-sharing site, but the traffic is encrypted and the server has no business reason to use that site. The analyst suspects data exfiltration. Which detection technique would be most effective in this scenario?

   • AMonitor DNS queries for the file-sharing domain
   • BBlock all traffic to the file-sharing site at the firewall
   • CCheck the server's event logs for failed logon attempts
   • DUse a network forensic tool to capture and analyze the TLS handshake and certificate details
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which technique is an example of a covert channel used for data exfiltration?

   • AEncoding stolen data in the least significant bits of image files
   • BUploading stolen files to a cloud storage service using HTTPS
   • CSending data in the body of an email to an external address
   • DCopying data to a USB drive and removing it from the building
   Reveal Solution Discussion Select an answer first