Cisco CyberOps Associate (CBROPS) 200-201Network Intrusion AnalysisMedium
A security analyst is investigating a suspected data exfiltration incident. They are reviewing network traffic logs and observe encrypted traffic leaving the internal network destined for an unusual external IP address on port 443. However, upon deeper inspection, the certificate presented by the external server is self-signed and the traffic pattern (small, sporadic bursts) is inconsistent with typical web browsing or legitimate encrypted data transfers. What is the most likely method of data exfiltration?
- ACleartext FTP transfer
- BEncrypted tunnel exfiltration
- CDNS tunneling
- DStandard HTTPS web traffic
Show answer & explanationAnswer & explanation
Correct answer: B. Encrypted tunnel exfiltration
Encrypted tunnel exfiltration is a common method where attackers establish a covert encrypted tunnel (often using TLS over non-standard ports or with self-signed certificates to avoid detection by standard HTTPS inspection) to extract data. The combination of encrypted traffic on port 443, a self-signed certificate, and unusual traffic patterns strongly points to this technique.
Why the other options are wrong
- A. Cleartext FTP transfer would not be encrypted and would use port 21, not 443, making it easily detectable.
- C. DNS tunneling uses DNS queries and responses to exfiltrate data, not encrypted traffic on port 443.
- D. Standard HTTPS would typically use valid, trusted certificates and exhibit different traffic patterns for web browsing or legitimate transfers.
Encrypted Tunnel Exfiltration
The process of extracting sensitive data from a network by encapsulating it within an encrypted tunnel, often using protocols like TLS/SSL over non-standard ports or with self-signed certificates.
- Aims to evade detection by blending with legitimate encrypted traffic.
- Often uses self-signed certificates or invalid certificates.
- Traffic patterns can be unusual (e.g., small, sporadic, inconsistent with protocols).
Memory trick: Exfiltration is like smuggling secrets out the back door.