nerdexam
Cisco

350-201 · Question #2

Refer to the exhibit. An engineer is analyzing this Vlan0392-int12-239.pcap file in Wireshark after detecting a suspicious network activity. The origin header for the direct IP connections in the…

The correct answer is C. There is a possible data leak because payloads should be encoded as UTF-8 text. A Chrome extension communicating over WebSocket with obfuscated, unreadable payloads indicates a possible data exfiltration because WebSocket text frames are required by RFC 6455 to carry UTF-8 encoded, human-readable data.

Security Monitoring

Question

Refer to the exhibit. An engineer is analyzing this Vlan0392-int12-239.pcap file in Wireshark after detecting a suspicious network activity. The origin header for the direct IP connections in the packets was initiated by a google chrome extension on a WebSocket protocol. The engineer checked message payloads to determine what information was being sent off-site but the payloads are obfuscated and unreadable. What does this STIX indicate?

Exhibit

350-201 question #2 exhibit

Options

  • AThe extension is not performing as intended because of restrictions since ports 80 and 443
  • BThe traffic is legitimate as the google chrome extension is reaching out to check for updates and
  • CThere is a possible data leak because payloads should be encoded as UTF-8 text
  • DThere is a malware that is communicating via encrypted channels to the command and control

How the community answered

(27 responses)
  • A
    22% (6)
  • B
    11% (3)
  • C
    59% (16)
  • D
    7% (2)

Why each option

A Chrome extension communicating over WebSocket with obfuscated, unreadable payloads indicates a possible data exfiltration because WebSocket text frames are required by RFC 6455 to carry UTF-8 encoded, human-readable data.

AThe extension is not performing as intended because of restrictions since ports 80 and 443

Port restrictions on 80 and 443 would block the WebSocket connection entirely rather than produce obfuscated payloads - the fact that communication is actively occurring rules out a port-blocking explanation.

BThe traffic is legitimate as the google chrome extension is reaching out to check for updates and

Legitimate extension update-check traffic uses structured, readable JSON payloads to known vendor endpoints and has no reason to obfuscate or encode its content.

CThere is a possible data leak because payloads should be encoded as UTF-8 textCorrect

The WebSocket protocol (RFC 6455) mandates that text frames carry valid UTF-8 encoded data. When payloads are obfuscated and unreadable instead of human-readable UTF-8 text, it strongly suggests the extension is encoding or serializing sensitive data for off-site transmission, which is a recognized indicator of data exfiltration activity.

DThere is a malware that is communicating via encrypted channels to the command and control

While C2 communication is a valid threat pattern, the evidence here more specifically points to data exfiltration via payload encoding rather than a bidirectional encrypted command-and-control channel.

Concept tested: WebSocket payload analysis for data exfiltration detection

Source: https://www.rfc-editor.org/rfc/rfc6455

Topics

#STIX#WebSocket#data exfiltration#obfuscated payload

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 350-201 Practice