350-201 Question 153
Select 3You are a cybersecurity analyst investigating a potential data exfiltration incident. You have a packet capture (PCAP) file from the suspect's machine. During your analysis, you identify a suspicious TCP stream. Which of the following artifacts or streams in the packet capture file would most likely help confirm data exfiltration activity?
- A
An HTTP POST request with a large payload size directed to an external IP address
- B
Encrypted DNS queries to known malicious domains
- C
FTP traffic containing files uploaded to an external server
- D
ICMP packets with irregular payloads potentially disguised as data transfers
- E
Regular HTTPS traffic between the suspect's machine and a known business application
Show answer and explanation
Correct answers: A, C, D
Explanation
Data exfiltration often involves unusual or suspicious network artifacts, such as large data transfers via HTTP POST, file uploads using FTP, or covert channels like ICMP with irregular payloads. Identifying these patterns in a packet capture file helps confirm exfiltration activity. While DNS queries and normal HTTPS traffic may be part of an investigation, they are less directly tied to data exfiltration in this scenario.
- A. Correct.
An HTTP POST request with a large payload size could indicate data being sent to an external server, which is a common method used in exfiltration scenarios.
- B. Incorrect.
Encrypted DNS queries to malicious domains typically indicate command-and-control (C2) activity rather than direct data exfiltration, making this less relevant to the question.
- C. Correct.
FTP traffic with uploaded files is a clear indicator of potential data exfiltration as files can be directly transferred to an external location.
- D. Correct.
ICMP packets with irregular payloads may be used as a covert channel for data exfiltration, which makes this a relevant artifact to investigate.
- E. Incorrect.
Regular HTTPS traffic to a known business application is unlikely to be associated with data exfiltration in this scenario unless the application itself is compromised, which is not suggested in the question.