An organization wants to ensure that its egress filtering policy prevents data exfiltration. Which egress filtering strategy is most effective?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because a default-deny egress policy with explicit allow rules for required destinations and protocols is the most restrictive and effective approach, limiting channels an attacker can use for exfiltration. A is wrong because blocking only known-malicious IPs is a block-listing approach that fails against unknown attacker infrastructure.
Full explanation below image
Full Explanation
B is correct because a default-deny egress policy with explicit allow rules for required destinations and protocols is the most restrictive and effective approach, limiting channels an attacker can use for exfiltration. A is wrong because blocking only known-malicious IPs is a block-listing approach that fails against unknown attacker infrastructure. C is wrong because limiting to ports 80/443 still allows exfiltration via HTTP/HTTPS to attacker-controlled servers. D is wrong because blocking ICMP prevents ping exfiltration but the technique is rarely used; attackers have many other exfiltration channels.