Data Exfiltration GDAT Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   An incident response team has confirmed that a server was compromised and data was exfiltrated to an external IP address. The team has isolated the server and collected a memory dump. What should the team do next to preserve evidence and support legal action?

   • ARebuild the server from a known-good image to restore service quickly
   • BNotify the external IP's ISP and ask them to preserve logs
   • CDocument the chain of custody for the memory dump and store it in a secure location
   • DDelete the memory dump to avoid exposing sensitive data
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A security analyst is reviewing proxy logs and sees a user account downloading a large file from a file-sharing site, then uploading a similarly sized file to a different file-sharing site minutes later. The user is in the marketing department and has no history of using file-sharing sites. What is the most likely explanation, and what should the analyst do first?

   • AThe user is definitely exfiltrating data; the analyst should block the user's access immediately
   • BThe user is downloading a legitimate file; the analyst should ignore the activity
   • CThe user's account is compromised; the analyst should reset the password and force re-authentication
   • DThe user may be exfiltrating data; the analyst should verify the file types and sizes with the user's manager before taking action
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   An organization wants to prevent sensitive data from being copied to USB drives by employees. They have already implemented a group policy that disables USB write access on all managed workstations. What additional control would provide a more robust defense-in-depth approach?

   • APhysically seal all USB ports on workstations.
   • BEducate employees about the policy against using USB drives.
   • CDeploy endpoint DLP software that monitors and blocks data transfers to removable media.
   • DDisable the USB controllers in the BIOS.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   During an incident response, you discover that an attacker has been using a covert channel over ICMP to exfiltrate data from a compromised server. The server is critical to business operations and cannot be taken offline. What is the best immediate containment action?

   • ADisconnect the server from the network.
   • BBlock ICMP traffic at the firewall for the affected server.
   • CChange the server's IP address.
   • DRebuild the server from a clean image.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Which scenario best describes physical data exfiltration?

   • AAn insider photographs a sensitive document with a smartphone
   • BAn attacker exploits a vulnerability to gain remote access to a server
   • CMalware encrypts files and demands a ransom for decryption
   • DAn attacker uses DNS queries to send stolen data to an external server
   Reveal Solution Discussion Select an answer first