Question

A security analyst is reviewing web proxy logs after a DLP alert fired. Over a 30-minute window, a single internal workstation made 214 HTTPS POST requests to 'files.mega-transfer-cloud[.]io', each transferring between 8 MB and 12 MB. The user's normal baseline shows almost exclusively GET requests to business SaaS domains. The destination domain was registered nine days ago and is not on any corporate allow list. Which conclusion is best supported by these proxy log indicators?

Accepted Answer

The repeated large HTTPS POST requests to a recently registered, unsanctioned cloud storage domain indicate probable data exfiltration to unauthorized cloud storage

Answer

The activity represents normal software update traffic, since HTTPS POST requests are used by patch-management agents

Answer

The pattern is consistent with a reflected denial-of-service attack originating from the workstation

Answer

The traffic indicates command-and-control beaconing because the requests occur at regular intervals