A security analyst is investigating a potential data exfiltration incident. The analyst sees a workstation sending data to a remote server using HTTP POST requests, but the data appears to be encrypted and the requests are small and frequent. The analyst also notices that the workstation is sending data to the same server using DNS queries with long subdomains. The analyst has limited time and resources. Which exfiltration technique is most likely being used, and what is the best detection method?

Email exfiltration; monitor the workstation's email logs

Physical exfiltration via USB; check the workstation's USB device history

HTTP tunneling combined with DNS tunneling; use a network forensic tool to correlate HTTP and DNS traffic to the same destination

Steganography in HTTP requests; use a DLP solution to inspect the content of the POST bodies

During an incident, a security analyst discovers that an attacker has been using a legitimate cloud storage service to upload sensitive files from a compromised workstation. The analyst has isolated the workstation. What should the analyst do next to preserve evidence and mitigate further loss?

Take a forensic image of the workstation and revoke the cloud storage access token used by the attacker

Notify the cloud storage provider and ask them to preserve the account data

Reimage the workstation and restore user data from backup

Delete the attacker's cloud storage account and all uploaded files immediately

A company wants to prevent employees from exfiltrating data via cloud storage services like Dropbox and Google Drive. They have a web proxy that can block categories of websites. Which additional control would be most effective to prevent exfiltration via these services?

Monitor DNS queries for cloud storage domains

Require employees to use a VPN for all internet access

Deploy a DLP solution that integrates with the web proxy to inspect files uploaded to cloud storage

Block all cloud storage websites at the proxy

A company is implementing controls to prevent data exfiltration. They have a strict requirement to allow employees to use personal cloud storage for non-sensitive documents, but must prevent sensitive data from being uploaded. They also need to maintain user productivity. Which approach best balances these requirements?

Require employees to request approval for each upload to personal cloud storage.

Block all access to personal cloud storage services.

Encrypt all data on endpoints so that even if it is uploaded, it is unreadable.

Deploy a CASB that can classify data and apply policies to allow non-sensitive uploads while blocking sensitive ones.

A security analyst notices that a server is sending outbound ICMP echo requests with payloads that contain what looks like file fragments. The payloads are larger than normal and the pattern repeats. Which exfiltration technique is being used, and what control would best detect it?

Covert channel via ICMP; enable deep packet inspection on the firewall to inspect ICMP payloads

DNS tunneling; monitor DNS query logs

Steganography in images; use a DLP solution that scans file content

Physical exfiltration; implement USB port controls

GIAC Defending Advanced Threats

Domain 4Objective 1

Data Exfiltration GDAT Practice Questions (Page 8)

Part of the Exfiltration and Emulation domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 5–8 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

4concepts

Questions 36–40

36expert · hard
A security analyst is investigating a potential data exfiltration incident. The analyst sees a workstation sending data to a remote server using HTTP POST requests, but the data appears to be encrypted and the requests are small and frequent. The analyst also notices that the workstation is sending data to the same server using DNS queries with long subdomains. The analyst has limited time and resources. Which exfiltration technique is most likely being used, and what is the best detection method?
Select an answer first
37application · medium
During an incident, a security analyst discovers that an attacker has been using a legitimate cloud storage service to upload sensitive files from a compromised workstation. The analyst has isolated the workstation. What should the analyst do next to preserve evidence and mitigate further loss?
Select an answer first
38application · medium
A company wants to prevent employees from exfiltrating data via cloud storage services like Dropbox and Google Drive. They have a web proxy that can block categories of websites. Which additional control would be most effective to prevent exfiltration via these services?
Select an answer first
39expert · hard
A company is implementing controls to prevent data exfiltration. They have a strict requirement to allow employees to use personal cloud storage for non-sensitive documents, but must prevent sensitive data from being uploaded. They also need to maintain user productivity. Which approach best balances these requirements?
Select an answer first
40application · medium
A security analyst notices that a server is sending outbound ICMP echo requests with payloads that contain what looks like file fragments. The payloads are larger than normal and the pattern repeats. Which exfiltration technique is being used, and what control would best detect it?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDAT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDAT” is a trademark of its owner, used for identification only.

Data Exfiltration GDAT Practice Questions (Page 8)

Questions 36–40

During an incident, a security analyst discovers that an attacker has been using a legitimate cloud storage service to upload sensitive files from a compromised workstation. The analyst has isolated the workstation. What should the analyst do next to preserve evidence and mitigate further loss?

A company wants to prevent employees from exfiltrating data via cloud storage services like Dropbox and Google Drive. They have a web proxy that can block categories of websites. Which additional control would be most effective to prevent exfiltration via these services?

A security analyst notices that a server is sending outbound ICMP echo requests with payloads that contain what looks like file fragments. The payloads are larger than normal and the pattern repeats. Which exfiltration technique is being used, and what control would best detect it?

Keep studying — Exfiltration and Emulation