200-201 Question 157
Select 3An attacker is attempting to exfiltrate sensitive data from a corporate network without being detected by security monitoring tools. The attacker disguises the malicious traffic within legitimate HTTPS traffic and routes it through an intermediary server to hide their origin. Which evasion and obfuscation techniques are being used in this scenario?
- A
Tunneling
- B
Encryption
- C
Proxies
- D
Code Injection
- E
Credential Harvesting
Show answer and explanation
Correct answers: A, B, C
Explanation
The attacker in the scenario uses a combination of tunneling, encryption, and proxies to evade detection. By encapsulating malicious traffic within HTTPS (tunneling), encrypting the data (encryption), and routing it through an intermediary server (proxies), the attacker successfully disguises their activities. These techniques are common methods used to bypass network security tools such as intrusion detection systems.
- A. Correct.
Tunneling is the process of encapsulating malicious traffic within legitimate network protocols, such as HTTPS, to evade detection. In this scenario, the attacker is using tunneling to blend malicious traffic with normal HTTPS traffic.
- B. Correct.
Encryption is used to secure the contents of communication, making it difficult for monitoring tools to inspect the traffic. Here, HTTPS encryption is being utilized to obfuscate the data being exfiltrated.
- C. Correct.
Proxies act as intermediaries to route traffic and hide the true source of communication. The attacker is using an intermediary server (a proxy) to disguise their origin.
- D. Incorrect.
Code injection involves inserting malicious code into a legitimate application or process. While a common attack technique, it is not relevant in this scenario where the focus is on traffic evasion and obfuscation.
- E. Incorrect.
Credential harvesting refers to stealing user credentials, such as usernames and passwords. This is unrelated to the described scenario, which focuses on traffic obfuscation techniques.