nerdexam
CompTIA

CAS-003 · Question #917

A company has a DLP system with the following capabilities: - Text examination - Optical character recognition - File type validation - Multilingual translation of key words and phrases - Blocking…

The correct answer is B. Scrambling the confidential information using a proprietary obfuscation scheme before sending the E. Leveraging stenography to hide the information within the JPEG files. The DLP system has strong coverage: text inspection, OCR, file-type validation, multilingual translation, and blocking of known-cipher encryption - yet the JPEG files passed as clean. The two techniques that bypass all listed capabilities are: (B) Proprietary obfuscation - the…

Enterprise Security Operations

Question

A company has a DLP system with the following capabilities:

  • Text examination
  • Optical character recognition
  • File type validation
  • Multilingual translation of key words and phrases
  • Blocking of content encrypted with a known cipher
  • Examination of all egress points

Despite the existing protections a malicious insider was able to exfilltrated confidential information DLP logs show the malicious insider transferred a number of JPEG files to an external host but each of those files appears as negative for the presence of confidential information. Which of the following are the MOST likely s for this issue? (Select TWO)

Options

  • ATranslating the confidential information horn English into Farsi and then into French to avoid
  • BScrambling the confidential information using a proprietary obfuscation scheme before sending the
  • CChanging the extension of Word files containing confidential information to jpg and uploading them
  • DPrinting the documents to TIFF images and attaching the files to outbound email messages
  • ELeveraging stenography to hide the information within the JPEG files
  • FPlacing the documents containing sensitive information into an AES-256 encrypted compressed

How the community answered

(34 responses)
  • A
    3% (1)
  • B
    59% (20)
  • C
    24% (8)
  • D
    3% (1)
  • F
    12% (4)

Explanation

The DLP system has strong coverage: text inspection, OCR, file-type validation, multilingual translation, and blocking of known-cipher encryption - yet the JPEG files passed as clean. The two techniques that bypass all listed capabilities are: (B) Proprietary obfuscation - the DLP blocks content 'encrypted with a known cipher' (e.g., AES, RSA). A custom or proprietary scrambling algorithm is not a recognized cipher, so the DLP has no signature to match; the data looks like noise and is not flagged. (E) Steganography - hiding data within the least-significant bits of JPEG pixel data produces a file that is a 100% valid JPEG. OCR finds no text because the hidden data is not rendered visually. File-type validation passes because it IS a JPEG. Text examination finds nothing because the payload is encoded in pixel values. Steganography detection is not listed as a DLP capability, confirming the gap. Option A fails because the DLP includes multilingual translation; Farsi and French are covered. Option C fails because file-type validation detects the true format regardless of the .jpg extension. Option D fails because the DLP uses OCR, which would extract text from TIFF images attached to outbound email. Option F fails because AES-256 is a well-known cipher and the DLP explicitly blocks content encrypted with known ciphers.

Topics

#DLP evasion#steganography#data exfiltration#insider threat

Community Discussion

No community discussion yet for this question.

Full CAS-003 Practice