Security Engineer has received alert from the DLP system that a certain marketing team user has created 20 image files, exactly the same size except for the last one, with a total size of 608494081…

Question

Options

• AThe last image should be investigated, as it has a different size and diverges from the pattern.
• BEngineer should contact the user and ask them why they are posting images with such regular sizes.
• CThe regularity of image-size is suspicious; engineer should investigate what other file on employee drive has that size.
• DSocial media often requires to re-use images; this is a regular user behavior; alert should be dismissed as false positive.

• A
  20% (11)
• B
  6% (3)
• C
  63% (34)
• D
  11% (6)

Explanation

Option C is correct because the uniform file sizes - 19 images of identical size with one remainder - is the classic signature of a file-splitting or steganography tool that embeds and chunks a larger source file into carrier images for exfiltration. The engineer's next logical step is to search the employee's drive for a file whose size matches what would have been hidden across those images, which would identify what was stolen.

Why the distractors are wrong:

• A is backwards - the last file being a different (smaller) size is expected in file-splitting (it's the natural remainder chunk), not the anomaly to focus on.
• B would tip off a potential insider threat before evidence is secured, violating proper incident response procedure.
• D ignores a clear DLP alert with a mathematically suspicious pattern; dismissing it without investigation is negligent.

Memory tip: Think "steganography splits evenly, last chunk is always the odd one out." When DLP shows images of suspiciously uniform size going to social media, your brain should jump to data exfiltration via steganography - and the next step is always to find the source file, not to contact the suspect.

No community discussion yet for this question.