SY0-301 · Question #239
A security analyst has been notified that trade secrets are being leaked from one of the executives in the corporation. When reviewing this executive's laptop they notice several pictures of the…
The correct answer is B. Steganography. Steganography is the technique of hiding secret data within ordinary-looking files such as images; mismatched file hashes indicate the images were modified to embed hidden information.
Question
A security analyst has been notified that trade secrets are being leaked from one of the executives in the corporation. When reviewing this executive's laptop they notice several pictures of the employee's pets are on the hard drive and on a cloud storage network. When the analyst hashes the images on the hard drive against the hashes on the cloud network they do not match. Which of the following describes how the employee is leaking these secrets?
Options
- ASocial engineering
- BSteganography
- CHashing
- DDigital signatures
How the community answered
(26 responses)- A23% (6)
- B58% (15)
- C12% (3)
- D8% (2)
Why each option
Steganography is the technique of hiding secret data within ordinary-looking files such as images; mismatched file hashes indicate the images were modified to embed hidden information.
Social engineering involves manipulating people psychologically to divulge information or grant access, not technically embedding data inside files.
Steganography conceals data within carrier files (such as JPEG images) by subtly altering bits in a way that is invisible to the human eye but changes the file's cryptographic hash. The fact that the images on the hard drive produce different hashes than the copies stored in the cloud confirms that hidden data was embedded into one set of files, and the trade secrets are being exfiltrated inside those modified image files.
Hashing is the forensic tool used to detect the file modification and verify integrity - it is not the method used to leak the data.
Digital signatures use asymmetric cryptography to verify the authenticity and integrity of data and are not a method for concealing or transmitting secret information.
Concept tested: Steganography for covert data exfiltration detection
Source: https://csrc.nist.gov/glossary/term/steganography
Topics
Community Discussion
No community discussion yet for this question.