CISSP · Question #190
Data leakage of sensitive information is MOST often concealed by which of the following?
The correct answer is A. Secure Sockets Layer (SSL). SSL/TLS encryption is commonly exploited by attackers to hide data exfiltration within encrypted traffic, making it difficult for security tools to inspect the contents of the transmission.
Question
Options
- ASecure Sockets Layer (SSL)
- BSecure Hash Algorithm (SHA)
- CWired Equivalent Privacy (WEP)
- DSecure Post Office Protocol (POP)
How the community answered
(32 responses)- A81% (26)
- B3% (1)
- C3% (1)
- D13% (4)
Why each option
SSL/TLS encryption is commonly exploited by attackers to hide data exfiltration within encrypted traffic, making it difficult for security tools to inspect the contents of the transmission.
SSL encrypts traffic between client and server, which is the same mechanism attackers exploit to conceal data leakage - malicious outbound data blends into legitimate encrypted HTTPS traffic, bypassing traditional deep packet inspection. Because the payload is encrypted, network monitoring tools cannot easily detect sensitive data being exfiltrated without SSL/TLS inspection capabilities. This makes SSL the most common method used to conceal data leakage.
SHA is a cryptographic hashing algorithm used for data integrity verification, not for encrypting or concealing data transmissions, so it cannot be used to hide exfiltrated data in transit.
WEP is a deprecated and easily cracked wireless encryption protocol that applies only to Wi-Fi network segments and is not used as a general mechanism to conceal data leakage over the internet.
Secure POP (POP3S) is a specific email retrieval protocol secured with TLS, and while it uses encryption, it is a narrow-use protocol not broadly used to conceal general data exfiltration the way SSL/TLS traffic is.
Concept tested: SSL encryption used to conceal data exfiltration
Source: https://www.cisa.gov/sites/default/files/publications/CISA-Insights_Detect-and-Prevent-Web-Shell-Malware_S508C.pdf
Topics
Community Discussion
No community discussion yet for this question.