Data Exfiltration GDAT Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A company handles sensitive customer data and wants to prevent employees from emailing that data to personal accounts. They already have an email gateway that scans for keywords. Which additional control would most directly address the risk of data exfiltration via email?

   • AIncrease the email attachment size limit to reduce user frustration.
   • BRequire employees to use a personal email account for business correspondence.
   • CEncrypt all outbound email using S/MIME.
   • DDeploy a data loss prevention (DLP) solution that inspects email content and attachments for sensitive data patterns and blocks or quarantines violations.
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A security team is investigating a sophisticated attacker who has been exfiltrating data from a high-security network. The attacker is using a combination of DNS tunneling and HTTPS to a legitimate cloud service. The team has limited resources and must prioritize their response. What is the most effective approach to detect and stop the exfiltration?

   • AFocus on blocking the cloud service IP addresses.
   • BFocus on blocking DNS tunneling by monitoring for unusual DNS queries.
   • CDeploy a combination of DNS monitoring and CASB to detect both DNS tunneling and cloud service abuse.
   • DDisconnect the high-security network from the internet.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A company wants to prevent sensitive data from being sent via email attachments. They have a DLP solution that can inspect email content and attachments. Which additional control would be most effective to prevent exfiltration via encrypted email attachments?

   • ADisable email attachments entirely for all users
   • BConfigure the DLP to decrypt and inspect encrypted attachments using a corporate key management system
   • CIncrease the email attachment size limit to reduce false positives
   • DBlock outbound email to personal domains and require encryption for all outbound email
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A security analyst is reviewing authentication logs and sees a user account logging in from a new IP address at 3 AM, then downloading a large database file from an internal server. The user is a junior employee who normally works 9–5. What should the analyst do first?

   • AIgnore the activity because the user may have a legitimate reason
   • BReset the user's password and force re-authentication
   • CContact the user to verify if they were working at that time
   • DDisable the user's account immediately
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A security team is reviewing network logs and sees a server that normally sends 2 MB of data per hour to a partner. Over the past week, the server has been sending 50 MB per hour to the same partner, but the partner reports no change in usage. The traffic is encrypted TLS. Which step should the team take first to determine if this is data exfiltration?

   • ACheck the server's process list and network connections to identify which process is generating the traffic
   • BBlock the partner's IP address at the firewall immediately
   • CRebuild the server from a known-good image
   • DDecrypt the TLS traffic using a man-in-the-middle proxy
   Reveal Solution Discussion Select an answer first