An in-house penetration tester has been asked to evade a new DLP system. The tester plans to exfiltrate data through steganography. Discovery of which of the following would help catch the tester in…

Obfuscated text in instant messages describes text-based encoding or encryption, not steganography, which by definition conceals data within non-text carrier files such as images or audio.

Encrypted zip files on USB drives represent local storage of data and potential physical exfiltration, not steganographic exfiltration over a network channel being monitored by a DLP system.

Steganography embeds hidden data within carrier files - most commonly image formats like PNG, BMP, or JPEG - causing those files to be larger than expected due to the additional payload. Outgoing emails with unusually large image files is the classic network-observable artifact of image-based steganography exfiltration. A DLP system inspecting file sizes and metadata anomalies in email attachments would flag this behavior as a potential data exfiltration attempt.

Unusual SFTP connections to a consumer IP address indicate suspicious file transfer protocol activity, but SFTP itself is not steganography - it is an encrypted file transfer mechanism and does not hide data within carrier media.