A retailer host is blocked from direct internet access, so it sends that traffic to an internal proxy that is allowed outbound, and the outside log shows the proxy rather than the host. What evasion is in use?
Select an answer to reveal the explanation.
Short Explanation
Think of a package counter that ships every parcel under the store's account, so the carrier never sees the clerk. Your outside log shows the allowed proxy, and that proxy is what hides the original client. The trap is calling it encryption, a buffer overflow, or ransomware when the path never needed those.
Full Explanation
The store host is not allowed to reach the internet directly, so it forwards that traffic to an internal proxy that is allowed outbound. The outside log then records the proxy, which means the original client has been obscured. The evasion is "An internal proxy that is allowed outbound and obscures the original client address". Hiding bytes on a path that never used a proxy is a different trick, and this session is defined by the proxy hop, so "Encryption of a direct flow that did not pass through a proxy and still hides the payload" does not fit. A buffer overflow corrupts memory inside a process. Nothing in the log says the application smashed a buffer in order to change the source, so "A buffer overflow in the store application that rewrites the source address seen outside" fails. Ransomware encrypts files and demands payment. It does not explain an allowed proxy appearing as the outside source, so "Ransomware on the store host that encrypts files and presents the proxy as the victim" fails. Exam caveat: a proxy can be an approved control and still be the path a blocked host rides outbound. Operational check: open the proxy log for the same window and pair the outside session with the original client address stored on the proxy.