Which of the following is not a common data exfiltration channel?

• A. DNS tunneling
• B. In-memory caching on the attacker's machine
• C. Removable media
• D. Email

Answer: (B)

Data exfiltration channels are the paths that move data from a compromised environment to an attacker-controlled location. The channels listed—DNS tunneling, email, and removable media—are classic ways data can be transmitted out: DNS tunneling hides data inside normal DNS traffic to slip past monitoring, email uses mail servers to deliver stolen information, and removable media physically transports data out of the network.

In-memory caching on the attacker's machine, however, stores data on the attacker’s side rather than providing a route to send it somewhere else. Without a transmission path to an external destination, cached data isn’t being exfiltrated. It may be staged locally for later exfiltration, but that caching by itself is not a data exfiltration channel. Hence, it is not a common channel used to move data out of the target environment.