nerdexam
GIAC

GCIH · Question #225

Which of the following types of channels is used by Trojans for communication?

The correct answer is C. Covert channel. Trojans use covert channels to communicate with attackers by hiding traffic within legitimate-looking protocols, allowing them to evade detection by security controls.

Malware Analysis & Advanced Persistent Threats

Question

Which of the following types of channels is used by Trojans for communication?

Options

  • ALoop channel
  • BOpen channel
  • CCovert channel
  • DOvert channel

How the community answered

(27 responses)
  • A
    7% (2)
  • B
    4% (1)
  • C
    89% (24)

Why each option

Trojans use covert channels to communicate with attackers by hiding traffic within legitimate-looking protocols, allowing them to evade detection by security controls.

ALoop channel

Loop channel is not a recognized term in networking or malware communication taxonomy and does not describe any method used by Trojans to communicate.

BOpen channel

An open channel is a publicly accessible and visible communication path, which Trojans deliberately avoid because the transparency would make detection and blocking trivial.

CCovert channelCorrect

A covert channel is a communication pathway that exploits system resources or protocols in unintended ways to transfer data without triggering security monitoring. Trojans use covert channels - such as encoding commands inside DNS queries, HTTP headers, or ICMP payloads - to receive instructions and exfiltrate data while appearing as normal traffic. This concealment is fundamental to Trojan design and is what distinguishes their communication from overt, detectable network activity.

DOvert channel

An overt channel is a standard, authorized communication pathway operating within normal protocol specifications, making it unsuitable for Trojans that must conceal their traffic from security monitoring.

Concept tested: Trojan covert channel communication methods

Source: https://csrc.nist.gov/glossary/term/covert_channel

Topics

#covert channels#trojan communication#C2 channels#malware persistence

Community Discussion

No community discussion yet for this question.

Full GCIH Practice