What is data exfiltration and which channels are commonly used?

• A. Authorized backup of data within the same system; channels include file system copy and local drive duplication.
• B. Deletion of data to avoid detection; channels include secure deletion and shredding.
• C. Unauthorized transfer of data from a system to an outside location; channels include email, cloud storage, FTP, DNS tunneling, and removable media.
• D. Real-time monitoring of data transfers for analytics; channels include HTTP logging and packet capture.

Answer: (C)

Data exfiltration is the unauthorized transfer of data from a system to an outside location, typically carried out to steal or leak sensitive information. This is best captured by listing common channels such as email, cloud storage, FTP, DNS tunneling, and removable media, which are avenues attackers or insiders might use to move data out of the network without permission. The other scenarios describe legitimate data movement (authorized backups within the same system), deliberate data destruction (deletion to avoid detection), or activity focused on watching data transfers (real-time monitoring), none of which describe covertly exporting data to an external destination.