Which of the following is one of the fields that Covert TCP uses to transmit data?

The correct answer is A. IP Options. Covert TCP is a steganographic tool that hides data inside standard TCP/IP packet header fields to create a covert communication channel. It encodes secret data into fields that are otherwise ignored or variable in normal traffic. The IP Options field is one such field Covert…

Malware Analysis & Advanced Persistent Threats

Question

Options

AIP Options
BUrgent Pointer
CIP Identification
DCode Bits

How the community answered

(59 responses)

A
88% (52)
B
2% (1)
C
5% (3)
D
5% (3)

Explanation

Covert TCP is a steganographic tool that hides data inside standard TCP/IP packet header fields to create a covert communication channel. It encodes secret data into fields that are otherwise ignored or variable in normal traffic. The IP Options field is one such field Covert TCP can exploit - it is rarely used in normal traffic, making it a useful hiding spot for covert data without disrupting legitimate network functionality. Other fields Covert TCP is known to use include the IP Identification field and the TCP Sequence Number. Option B (Urgent Pointer) and Option C (IP Identification) are also used by covert channel tools, but for this exam question, IP Options (A) is the designated correct answer. Option D (Code Bits / TCP flags) are functional control bits and not used for covert data storage.

Topics

#covert channel#TCP header#IP Options#data exfiltration

Community Discussion

No community discussion yet for this question.

Full GCIH Practice