At a manufacturer, a captured payload is encrypted, while the IP header still shows the address where the packet was sent. Which element remains usable for scoping the flow?
Select an answer to reveal the explanation.
Short Explanation
The address on the envelope is still readable when the letter inside is written in code. You can scope this flow from the destination the IP header still shows. The trap is claiming the file body, the HTTP URI, or the password is readable inside the encryption.
Full Explanation
Encrypting the payload hides the application bytes and leaves the IP header available when the capture still shows that header. The destination address in the header is therefore still usable to scope where the packet was sent. The destination address in the IP header, still visible outside the encrypted payload, is the element that remains usable. The cleartext body of the transferred file, still readable inside the encrypted payload bytes, would require the file contents to be in the clear, and the payload is encrypted. The HTTP request URI, still readable as plain text from inside the encrypted payload bytes, sits in the application data after a protected session is established, so it is not readable from the ciphertext. The user password, still carried in readable form inside the encrypted payload bytes, is not exposed by an encrypted payload and is not a header field you can scope from. On the exam, the visible destination may be a proxy or a tunnel endpoint if that is what the header contains, so scope the address you can actually see. In operations, record the visible destination and do not export this payload as a clear HTTP object.