CEH Enumeration and System Hacking Practice Question
A security team discovers that an attacker has been using steganography to exfiltrate data from the corporate network. The attacker hid data inside image files and uploaded them to a public image hosting site. Which of the following is the BEST method to detect this type of exfiltration?
⚠ Common exam trap
It's easy for candidates to confuse steganography detection with file integrity checking (Option A) or assume header inspection (Option D) can find hidden data, when in fact steganography operates at the pixel or transform coefficient level, not in metadata.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy a steganography detection tool that analyzes image pixel patterns for statistical anomalies
Steganography detection tools analyze statistical anomalies in pixel patterns (e.g., LSB embedding, DCT coefficient deviations) that are invisible to the human eye but detectable via algorithms like chi-square analysis or RS analysis. This directly identifies hidden payloads without relying on file hashes or headers, which steganography does not alter.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Compare file hashes of uploaded images to known-good baselines
Why it's wrong here
Comparing file hashes of uploaded images to known-good baselines is ineffective for detecting steganography because any modification, including the embedding of hidden data, will fundamentally alter the file's hash value. While this method can confirm a file has been changed, it cannot differentiate between legitimate modifications (e.g., compression artifacts) and malicious steganographic embedding. A changed hash merely indicates alteration, not the specific nature of that alteration, making it a poor indicator for hidden data.
- ✓
Deploy a steganography detection tool that analyzes image pixel patterns for statistical anomalies
Why this is correct
Deploying a steganography detection tool, also known as a steganalysis tool, is the most effective approach as these specialized utilities are designed to identify the subtle statistical anomalies introduced into image pixel patterns by embedded data. These tools analyze various image properties, such as Least Significant Bit (LSB) distributions or Discrete Cosine Transform (DCT) coefficients, to detect deviations from expected statistical models of 'clean' images. By identifying these irregularities, they can reliably flag images likely containing hidden information.
- ✗
Block all image uploads to external sites
Why it's wrong here
Blocking all image uploads prevents the exfiltration channel entirely but fails to detect existing steganography hidden within legitimate traffic. This approach is a preventative control designed to reduce the attack surface by enforcing strict egress filtering policies. It becomes an effective strategy when an organisation aims to minimise data leakage risks through unauthorised web services, rather than identifying malicious content embedded inside permitted file types.
- ✗
Use network-based DLP to inspect image file headers for hidden data
Why it's wrong here
Using network-based Data Loss Prevention (DLP) to inspect image file headers for hidden data is generally ineffective for detecting steganography. Steganography typically embeds data within the image's payload, such as the pixel data itself, rather than altering the file header, which contains metadata about the image format. While DLP can inspect for sensitive content patterns, it is not designed to perform the complex statistical analysis required to uncover data hidden within the visual information layer of an image file.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.