nerdexam
EC-Council

312-50V9 · Question #43

One way to defeat a multi-level security solution is to leak data via

The correct answer is C. a covert channel. Multi-level security (MLS) systems enforce information flow policies between security levels, but covert channels bypass these controls by using unintended communication paths not governed by the security policy.

Cryptography

Question

One way to defeat a multi-level security solution is to leak data via

Options

  • Aa bypass regulator.
  • Bsteganography.
  • Ca covert channel.
  • Dasymmetric routing.

How the community answered

(20 responses)
  • A
    15% (3)
  • B
    5% (1)
  • C
    70% (14)
  • D
    10% (2)

Why each option

Multi-level security (MLS) systems enforce information flow policies between security levels, but covert channels bypass these controls by using unintended communication paths not governed by the security policy.

Aa bypass regulator.

A 'bypass regulator' is not a recognized technical term or attack technique in security literature.

Bsteganography.

Steganography hides data within carrier files such as images, but it is a concealment technique rather than a method that exploits unintended communication paths to defeat MLS information flow controls.

Ca covert channel.Correct

A covert channel is a communication mechanism that was not intended to exist in the system design, allowing information to be transferred in ways that circumvent mandatory access controls enforced by MLS solutions. Because MLS policies only govern intended channels, covert channels - such as timing channels or storage channels - can leak data across security boundaries undetected. This is the classic attack vector specifically studied in the context of defeating MLS architectures.

Dasymmetric routing.

Asymmetric routing describes a network condition where traffic takes different paths in each direction, which is a routing anomaly and not a technique used to leak data past MLS security boundaries.

Concept tested: Covert channels defeating multi-level security

Source: https://csrc.nist.gov/publications/detail/sp/800-83/rev-1/final

Topics

#covert channel#multi-level security#data exfiltration#information leakage

Community Discussion

No community discussion yet for this question.

Full 312-50V9 Practice