What is data exfiltration, and which channels are commonly used to exfiltrate data?

• A. Local file copy
• B. Intra-network file sharing only
• C. Authorized data transfer
• D. Unauthorized transfer of data outside the organization; channels include email, cloud storage, USB, DNS tunneling

Answer: (D)

Data exfiltration is the unauthorized transfer of data outside the organization. It describes moving sensitive information beyond the network’s defenses, often to evade monitoring and controls.

Why the described answer fits best: it defines exfiltration accurately as outside-the-network movement and enumerates common channels attackers use to slip data out. Email can carry attachments or links to exfiltrated data, cloud storage lets an attacker upload information for later retrieval, USB devices enable physical copying, and DNS tunneling uses normal DNS traffic to covertly transmit data, often bypassing traditional security controls. These channels illustrate the variety of paths exfiltration can take.

Why the other options aren’t a fit: a local file copy stays on the same device, not moving data out of the organization; intra-network file sharing remains within the internal network; authorized data transfer is legitimate and permitted, not an unauthorized exfiltration activity.