You work for Acme Corporation as Sales Manager. The company has tight network security restrictions. You are trying to steal data from the company's Sales database (Sales.xls) and transfer them to…

PGP-encrypted email attachments can still be flagged by DLP systems based on attachment metadata, file size anomalies, encryption detection policies, or email content rules - encrypted attachments from internal users to personal accounts are a known DLP trigger.

Trojan-wrapped executables would almost certainly be detected by endpoint antivirus or perimeter security, and outbound telnet traffic (port 23) is highly anomalous and would immediately raise alerts on a monitored network.

Steganography involves embedding one file's data within another carrier file (such as hiding Sales.xls content inside photo.jpg) at the bit level, making the resulting file appear as a normal image to both visual inspection and signature-based DLP tools. Network monitoring systems that filter by file type, content signatures, or keywords will not detect the hidden payload because the carrier file appears legitimate. This technique evades inspection without triggering alerts based on encrypted attachments, unusual protocols, or suspicious file extensions.

Renaming a file extension does not change the file's internal structure or magic bytes; DLP and content inspection tools perform deep packet inspection and file signature analysis, not just extension checking.