CAS-003 · Question #917
A company has a DLP system with the following capabilities: - Text examination - Optical character recognition - File type validation - Multilingual translation of key words and phrases - Blocking…
The correct answer is B. Scrambling the confidential information using a proprietary obfuscation scheme before sending the E. Leveraging stenography to hide the information within the JPEG files. The DLP system has strong coverage: text inspection, OCR, file-type validation, multilingual translation, and blocking of known-cipher encryption - yet the JPEG files passed as clean. The two techniques that bypass all listed capabilities are: (B) Proprietary obfuscation - the…
Question
A company has a DLP system with the following capabilities:
- Text examination
- Optical character recognition
- File type validation
- Multilingual translation of key words and phrases
- Blocking of content encrypted with a known cipher
- Examination of all egress points
Despite the existing protections a malicious insider was able to exfilltrated confidential information DLP logs show the malicious insider transferred a number of JPEG files to an external host but each of those files appears as negative for the presence of confidential information. Which of the following are the MOST likely s for this issue? (Select TWO)
Options
- ATranslating the confidential information horn English into Farsi and then into French to avoid
- BScrambling the confidential information using a proprietary obfuscation scheme before sending the
- CChanging the extension of Word files containing confidential information to jpg and uploading them
- DPrinting the documents to TIFF images and attaching the files to outbound email messages
- ELeveraging stenography to hide the information within the JPEG files
- FPlacing the documents containing sensitive information into an AES-256 encrypted compressed
How the community answered
(34 responses)- A3% (1)
- B59% (20)
- C24% (8)
- D3% (1)
- F12% (4)
Explanation
The DLP system has strong coverage: text inspection, OCR, file-type validation, multilingual translation, and blocking of known-cipher encryption - yet the JPEG files passed as clean. The two techniques that bypass all listed capabilities are: (B) Proprietary obfuscation - the DLP blocks content 'encrypted with a known cipher' (e.g., AES, RSA). A custom or proprietary scrambling algorithm is not a recognized cipher, so the DLP has no signature to match; the data looks like noise and is not flagged. (E) Steganography - hiding data within the least-significant bits of JPEG pixel data produces a file that is a 100% valid JPEG. OCR finds no text because the hidden data is not rendered visually. File-type validation passes because it IS a JPEG. Text examination finds nothing because the payload is encoded in pixel values. Steganography detection is not listed as a DLP capability, confirming the gap. Option A fails because the DLP includes multilingual translation; Farsi and French are covered. Option C fails because file-type validation detects the true format regardless of the .jpg extension. Option D fails because the DLP uses OCR, which would extract text from TIFF images attached to outbound email. Option F fails because AES-256 is a well-known cipher and the DLP explicitly blocks content encrypted with known ciphers.
Topics
Community Discussion
No community discussion yet for this question.