CAS-001 · Question #516
A large bank deployed a DLP solution to detect and block customer and credit card data from leaving the organization via email. A disgruntled employee was able to successfully exfiltrate data…
The correct answer is A. The product does not understand how to decode embedded objects. C. The process of embedding an object obfuscates the data. Most DLP solutions inspect file attachments by recognizing known file formats and scanning their contents for patterns like credit card numbers or PII. When a Word document is embedded as an object inside a CAD file, two problems arise: First (A), many DLP engines do not have…
Question
A large bank deployed a DLP solution to detect and block customer and credit card data from leaving the organization via email. A disgruntled employee was able to successfully exfiltrate data through the corporate email gateway by embedding a word processing document containing sensitive data as an object in a CAD file. Which of the following BEST explains why it was not detected and blocked by the DLP solution? (Select TWO).
Options
- AThe product does not understand how to decode embedded objects.
- BThe embedding of objects in other documents enables document encryption by default.
- CThe process of embedding an object obfuscates the data.
- DThe mail client used to send the email is not compatible with the DLP product.
- EThe DLP product cannot scan multiple email attachments at the same time.
How the community answered
(29 responses)- A48% (14)
- B28% (8)
- D17% (5)
- E7% (2)
Explanation
Most DLP solutions inspect file attachments by recognizing known file formats and scanning their contents for patterns like credit card numbers or PII. When a Word document is embedded as an object inside a CAD file, two problems arise: First (A), many DLP engines do not have the capability to recursively parse nested or embedded object structures within binary file formats like CAD files - they inspect the outer container but cannot decode what is embedded inside. Second (C), the act of embedding inherently obfuscates the sensitive data because it is no longer a standalone, inspectable document - it is encoded/serialized within the structure of a different file format, making pattern-matching against the raw bytes ineffective. Together, these two factors allowed the data to pass undetected through the email gateway.
Topics
Community Discussion
No community discussion yet for this question.