PT0-003 · Question #278
Which of the following protocols would a penetration tester most likely utilize to exfiltrate data covertly and evade detection?
The correct answer is D. DNS. DNS Tunneling for Covert Data Exfiltration DNS is the correct choice because DNS traffic is almost universally allowed through firewalls and is rarely inspected in depth, making it an ideal covert channel. Attackers encode stolen data within DNS query/response packets (a…
Question
Which of the following protocols would a penetration tester most likely utilize to exfiltrate data covertly and evade detection?
Options
- AFTP
- BHTTP
- CSMTP
- DDNS
How the community answered
(58 responses)- A16% (9)
- B5% (3)
- C3% (2)
- D76% (44)
Explanation
DNS Tunneling for Covert Data Exfiltration
DNS is the correct choice because DNS traffic is almost universally allowed through firewalls and is rarely inspected in depth, making it an ideal covert channel. Attackers encode stolen data within DNS query/response packets (a technique called DNS tunneling), blending malicious traffic with normal name resolution activity that security tools often overlook. FTP (A) is incorrect because it uses well-known ports (20/21) that are frequently blocked or monitored, making it easily detectable. HTTP (B) can be used for exfiltration but generates more scrutiny through proxies and web filters compared to DNS. SMTP (C) is an email protocol that is heavily monitored for data loss prevention (DLP) and would trigger alerts when sending large volumes of data.
Memory Tip: Think "DNS = Do Not Suspect" - because DNS is considered essential infrastructure, security teams rarely block or deeply inspect it, making it the perfect hiding place for a penetration tester trying to fly under the radar.
Topics
Community Discussion
No community discussion yet for this question.