CAS-002 · Question #245
A large bank deployed a DLP solution to detect and block customer and credit card data from leaving the organization via email. A disgruntled employee was able to successfully exfiltrate data…
The correct answer is A. The product does not understand how to decode embedded objects. C. The process of embedding an object obfuscates the data. The DLP solution failed because it lacked the ability to decode objects embedded within compound document formats and because the embedding process itself obfuscated the sensitive data from the inspection engine.
Question
A large bank deployed a DLP solution to detect and block customer and credit card data from leaving the organization via email. A disgruntled employee was able to successfully exfiltrate data through the corporate email gateway by embedding a word processing document containing sensitive data as an object in a CAD file. Which of the following BEST explains why it was not detected and blocked by the DLP solution? (Select TWO).
Options
- AThe product does not understand how to decode embedded objects.
- BThe embedding of objects in other documents enables document encryption by default.
- CThe process of embedding an object obfuscates the data.
- DThe mail client used to send the email is not compatible with the DLP product.
- EThe DLP product cannot scan multiple email attachments at the same time.
How the community answered
(26 responses)- A65% (17)
- B12% (3)
- D4% (1)
- E19% (5)
Why each option
The DLP solution failed because it lacked the ability to decode objects embedded within compound document formats and because the embedding process itself obfuscated the sensitive data from the inspection engine.
Many DLP solutions inspect the outermost file type but lack the capability to recursively parse and decode objects embedded within compound document formats such as CAD files, leaving the embedded Word document's content completely uninspected.
Embedding an object within another document does not automatically enable encryption - the data is obfuscated through structural nesting within the file format, not through cryptographic means.
Embedding a Word document as an object inside a CAD file changes the binary structure of the data, effectively obfuscating the sensitive content from pattern-matching engines that do not perform deep recursive content extraction on nested object structures.
Mail client compatibility with the DLP product is unrelated to this failure because the DLP operates at the gateway level and inspects the attachment regardless of which client was used to send it.
The inability to scan multiple attachments simultaneously does not apply here because only a single CAD file attachment was sent - the failure was specifically about the inability to extract nested content within that one file.
Concept tested: DLP inspection limitations with embedded compound documents
Topics
Community Discussion
No community discussion yet for this question.