350-201 Question 155
Select 3While investigating a suspected data exfiltration incident, you analyze a packet capture (PCAP) file. You notice multiple TCP streams with unusually large payloads being transmitted to an external IP address. Which of the following artifacts or streams from the PCAP file would you evaluate to confirm whether sensitive data was exfiltrated?
- A
Inspect the payloads of the TCP streams for readable plain-text sensitive data.
- B
Check for encrypted traffic and verify if the encryption protocol is using a known secure standard.
- C
Analyze DNS queries in the packet capture for any suspicious domain names.
- D
Review HTTP POST requests to identify if large amounts of data were sent to external servers.
- E
Examine ARP traffic for unusual address resolutions.
Show answer and explanation
Correct answers: A, C, D
Explanation
To confirm data exfiltration in a packet capture file, you should evaluate streams and artifacts that directly indicate data transfer, such as TCP payloads, suspicious DNS activity, and HTTP POST requests. These artifacts can reveal the presence of sensitive data leaving the network or communication with malicious external entities.
- A. Correct.
Inspecting the payloads of the TCP streams is critical to confirm if sensitive data, like plain-text credentials or files, has been transmitted.
- B. Incorrect.
Analyzing the encryption protocol is important for ensuring secure communication, but it does not directly confirm data exfiltration unless encryption anomalies are present.
- C. Correct.
Suspicious DNS queries, such as queries to uncommon or newly registered domains, can indicate command-and-control communication or data exfiltration.
- D. Correct.
HTTP POST requests are commonly used to upload data to servers, making them a key artifact to evaluate for potential exfiltration.
- E. Incorrect.
ARP traffic analysis typically focuses on identifying network mapping or spoofing, not data exfiltration.