A penetration tester is trying to execute a post-exploitation activity and creates the follow script: Which of the following best describes the tester's objective?

Question

Exhibit

Options

• ATo download data from an API endpoint
• BTo download data from a cloud storage
• CTo exfiltrate data over alternate data streams
• DTo exfiltrate data to cloud storage

• A
  12% (4)
• B
  15% (5)
• C
  3% (1)
• D
  71% (24)

Explanation

Explanation

Option D is correct because post-exploitation scripts that interact with cloud storage services (such as AWS S3, Azure Blob, or Google Cloud Storage) using authentication tokens or API keys are specifically designed to upload/send stolen data to attacker-controlled cloud buckets, which is classic data exfiltration to cloud storage. Option A is incorrect because simply downloading from an API endpoint is not a post-exploitation exfiltration activity - it's a passive data retrieval action. Option B is wrong because the script is sending data outbound to cloud storage, not downloading from it; the direction of data flow matters here. Option C is incorrect because alternate data streams (ADS) are a Windows NTFS filesystem technique used to hide data locally, not a method involving cloud services or network transmission.

Memory Tip: Think "Post-exploitation = attacker has access, now they want to TAKE data OUT." If the script involves cloud storage credentials and is running after compromise, the goal is always to exfiltrate TO the cloud - the attacker controls the destination, not the victim.

No community discussion yet for this question.