Question

Malware and attackers will typically use one location to stage data for exfiltration (data theft) on a device. These areas are typically compressed and encrypted, so they are easy to move and hard to detect.

Which of the following are often used as staging areas on a Windows device? (Select two.)

answer

User profile folders


Program File directories


Policy files


Log files


Program Data

Answer 1

User profile folders
Program Data

Rationale: User profiles (Desktop, Documents, AppData) are always writable by the user and commonly used to assemble/exfiltrate files. ProgramData is a shared, often-writable hidden folder used by apps and attackers to stash compressed/encrypted bundles without needing elevated access.