nerdexam
(ISC)2

CISSP-ISSAP · Question #195

John used to work as a Network Administrator for We-are-secure Inc. Now he has resigned from the company for personal reasons. He wants to send out some secret information of the company. To do so, he

The correct answer is D. Steganography. John is performing steganography (D) - the practice of hiding secret data within an ordinary, non-suspicious file (here, an image) so that the existence of the hidden message is itself concealed. The tool "image hide" embeds the secret file inside the image's binary data, making

Infrastructure Security

Question

John used to work as a Network Administrator for We-are-secure Inc. Now he has resigned from the company for personal reasons. He wants to send out some secret information of the company. To do so, he takes an image file and simply uses a tool image hide and embeds the secret file within an image file of the famous actress, Jennifer Lopez, and sends it to his Yahoo mail id. Since he is using the image file to send the data, the mail server of his company is unable to filter this mail. Which of the following techniques is he performing to accomplish his task?

Options

  • AEmail spoofing
  • BSocial engineering
  • CWeb ripping
  • DSteganography

How the community answered

(27 responses)
  • A
    11% (3)
  • B
    4% (1)
  • C
    7% (2)
  • D
    78% (21)

Explanation

John is performing steganography (D) - the practice of hiding secret data within an ordinary, non-suspicious file (here, an image) so that the existence of the hidden message is itself concealed. The tool "image hide" embeds the secret file inside the image's binary data, making it invisible to casual inspection and undetectable by content-filtering mail servers looking for suspicious attachments.

Why the distractors are wrong:

  • A (Email spoofing): Spoofing involves forging the sender address to impersonate someone else - John isn't faking his identity here.
  • B (Social engineering): Social engineering manipulates people psychologically to divulge information; no human manipulation is occurring.
  • C (Web ripping): Web ripping is copying/downloading an entire website's content - unrelated to hiding data in files.

Memory tip: Think of the word root - steganos (Greek for "covered/hidden") + graphia (writing). Steganography = "hidden writing inside something innocent." If the question describes data hidden inside an image, audio, or video file to bypass detection, it's always steganography.

Topics

#Steganography#Data exfiltration#Covert channels#Email security bypass

Community Discussion

No community discussion yet for this question.

Full CISSP-ISSAP Practice