exfiltration

Cloud attackers mostly use the same APIs your engineers do. The scored answer collects the right logs, writes detections for attacker behaviour, and keeps the logs out of the attacker's reach.

Use the historical EchoLeak advisory and an original worked trace to distinguish delivery, actual exposure, generated output and release. Choose verifiable controls without implying the old vulnerability remains open.

Separate Unicode normalization, hidden controls, bidirectional display and confusable identifiers. Use a harmless offline example to choose field-specific checks without damaging legitimate language.

Interpret a canary hit using placement, known copies, audience and delivery evidence. Separate a local marker check from an active callback and from complete leak prevention.

The question catches candidates who think exfiltration needs a tool. The answer that scores starts with the browser and ends with deterministic controls in the client.

Rendering is an outbound channel. The scored answer removes images, rewrites unapproved links, strips raw HTML, and only releases streamed text once it can no longer turn into something dangerous.

Inventory the data, untrusted inputs and outbound routes, including tools with two roles. Propose one enforced restriction and explain what the first pass leaves unresolved.

Trace which private data can reach which destinations when browsing and email share a task. Rank harms by the capabilities and checks actually present, and preserve useful combined workflows within a narrow grant.