A penetration tester discovers data to stage and exfiltrate. The client has authorized movement to the tester's attacking hosts only. Which of the following would be most appropriate to avoid…

The correct answer is D. Apply AES-256 to the data and send over a tunnel to TCP port 443. AES-256 (Advanced Encryption Standard with a 256-bit key) is a symmetric encryption algorithm widely used for securing data. Sending data over TCP port 443, which is typically used for HTTPS, helps to avoid detection by network monitoring systems as it blends with regular secure

Submitted by kim_seoul· Mar 6, 2026Post-exploitation and Lateral Movement

Question

A penetration tester discovers data to stage and exfiltrate. The client has authorized movement to the tester's attacking hosts only. Which of the following would be most appropriate to avoid alerting the SOC?

Options

AApply UTF-8 to the data and send over a tunnel to TCP port 25.
BApply Base64 to the data and send over a tunnel to TCP port 80.
CApply 3DES to the data and send over a tunnel UDP port 53.
DApply AES-256 to the data and send over a tunnel to TCP port 443.

How the community answered

(40 responses)

A
5% (2)
B
23% (9)
C
10% (4)
D
63% (25)

Explanation

AES-256 (Advanced Encryption Standard with a 256-bit key) is a symmetric encryption algorithm widely used for securing data. Sending data over TCP port 443, which is typically used for HTTPS, helps to avoid detection by network monitoring systems as it blends with regular secure

Topics

#data exfiltration#covert channels#encryption#network protocols

Community Discussion

No community discussion yet for this question.

Full PT0-003 Practice