CPENT Practice Question: Privilege Escalation Lateral Movement And Post Exploitation
An operator is performing data exfiltration from a highly secure network environment where all outbound TCP and UDP ports except 53 are blocked by a strict egress firewall. Furthermore, DNS queries are monitored and restricted to the internal corporate DNS servers. Which advanced exfiltration technique can the operator use to bypass this restriction?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Tunnel data through DNS queries using TXT records sent to a domain controlled by the attacker
DNS tunneling encapsulates arbitrary data within DNS query and response types (such as TXT, NULL, or CNAME records) sent to an authoritative nameserver controlled by the attacker, effectively bypassing egress filtering on port 53.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use standard FTP data channels over ephemeral ports to push archives to an external staging server
Why it's wrong here
Incorrect because ephemeral ports and FTP are blocked by the strict egress firewall.
- ✓
Tunnel data through DNS queries using TXT records sent to a domain controlled by the attacker
Why this is correct
Correct because DNS port 53 is open and TXT records allow arbitrary string data to be exfiltrated via queries to an attacker-controlled nameserver.
- ✗
Establish an ICMP reverse shell by embedding data inside the payload of ICMP echo request packets
Why it's wrong here
Incorrect because ICMP traffic is typically blocked or heavily restricted by corporate perimeter firewalls.
- ✗
Establish an HTTPS connection to an external IP address using port 443
Why it's wrong here
Incorrect because port 443 is explicitly blocked by the strict egress firewall policy described in the scenario.
Visual reference
About these practice questions
One of 276 original CPENT practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official EC-Council exam blueprint
This CPENT practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CPENT exam.