Question

A SOC analyst reviewing NetFlow records notices that a workstation in the finance department, which normally generates only small bursts of outbound traffic, has been sending 4 GB of data over the course of one night to an unfamiliar external IP address on TCP port 443. The internal file server it accessed contains sensitive customer records. Based on this traffic profile, what does this activity most likely indicate?

Accepted Answer

Potential data exfiltration, where sensitive data is being smuggled out over an encrypted channel

Answer

A normal software update being downloaded from a vendor content delivery network

Answer

A denial-of-service attack targeting the workstation from the external IP

Answer

Routine backup traffic between the workstation and an internal storage array