350-201 Question 156
Select 3You are analyzing a packet capture (PCAP) file to investigate a potential data exfiltration incident. During your analysis, you discover a stream containing HTTP traffic. The stream includes an outbound POST request with a suspiciously large payload. Which of the following artifacts or streams should you evaluate further to confirm data exfiltration?
- A
The payload of the HTTP POST request for sensitive or encoded data
- B
The destination IP address and its reputation
- C
The User-Agent string used in the HTTP request for anomalies
- D
DNS queries made by the host prior to the HTTP POST request
- E
The MAC address of the source device in the Ethernet frame
Show answer and explanation
Correct answers: A, B, D
Explanation
To determine if data exfiltration occurred, you must investigate artifacts and streams that provide evidence of sensitive data leaving the network. The HTTP POST payload may contain the actual data being exfiltrated, while the destination IP address and its reputation can indicate where the data was sent. DNS queries prior to the HTTP POST request may reveal if the host resolved a suspicious or malicious domain, supporting the exfiltration hypothesis. Other details, such as the MAC address or User-Agent string, are less critical for confirming exfiltration in this scenario.
- A. Correct.
The payload of the HTTP POST request could contain sensitive data being exfiltrated, such as encoded files or confidential information. This is a critical artifact to analyze in a data exfiltration investigation.
- B. Correct.
The destination IP address can provide insight into whether the data is being sent to a known malicious or suspicious server, which is a strong indicator of exfiltration.
- C. Incorrect.
While the User-Agent string may provide context about the application or tool used, it is less directly relevant to confirming data exfiltration compared to other artifacts.
- D. Correct.
DNS queries made prior to the HTTP POST request can reveal if the host resolved a suspicious domain, which could be part of a data exfiltration mechanism.
- E. Incorrect.
The MAC address of the source device is not directly relevant to identifying or confirming data exfiltration, as it does not provide information about the content or intent of the traffic.