SY0-301 · Question #484
Ann, a security analyst, has been notified that trade secrets are being leaked from one of the executives in the corporation. When reviewing this executive's laptop she notices several pictures of…
The correct answer is B. Steganography. Steganography is the practice of hiding secret data within ordinary, non-secret files such as images. The mismatched hashes between the drive and cloud copies confirm the images were modified to carry hidden data.
Question
Ann, a security analyst, has been notified that trade secrets are being leaked from one of the executives in the corporation. When reviewing this executive's laptop she notices several pictures of the employee's pets are on the hard drive and on a cloud storage network. When Ann hashes the images on the hard drive against the hashes on the cloud network they do not match. Which of the following describes how the employee is leaking these secrets?
Options
- ASocial engineering
- BSteganography
- CHashing
- DDigital signatures
How the community answered
(33 responses)- A27% (9)
- B55% (18)
- C6% (2)
- D12% (4)
Why each option
Steganography is the practice of hiding secret data within ordinary, non-secret files such as images. The mismatched hashes between the drive and cloud copies confirm the images were modified to carry hidden data.
Social engineering involves manipulating people through deception or psychological tactics to gain information or access, and does not describe the technical method of embedding data in image files.
Steganography conceals information within a carrier file - in this case, images of pets - so that the existence of the hidden message is not obvious. The fact that the MD5/hash values of the images on the hard drive do not match those on the cloud network proves the files were altered, which is consistent with secret data being embedded in the images. This technique allows the executive to exfiltrate trade secrets while the files appear to be ordinary personal photos.
Hashing is the method Ann used to detect that the images were different - it is a detection technique, not the method of leaking data.
Digital signatures are used to verify the authenticity and integrity of a message or file and are not a technique for hiding or exfiltrating secret data.
Concept tested: Steganography as a data exfiltration method
Source: https://csrc.nist.gov/glossary/term/steganography
Topics
Community Discussion
No community discussion yet for this question.