200-201 Question 87
Select 3A security analyst is monitoring network traffic and notices an unusual amount of outbound data from a high-privilege database server during non-business hours. Upon further inspection, the traffic is being sent to an external IP address. Which of the following could be potential indicators of data loss in this scenario?
- A
Unexpected large data transfers during periods of low activity
- B
Outbound traffic directed toward known internal IP addresses
- C
Traffic patterns matching known file transfer protocols, such as FTP or HTTP, going to external destinations
- D
A sudden increase in encrypted traffic to an external destination
- E
Normal traffic patterns with no anomalies or deviation from the baseline
Show answer and explanation
Correct answers: A, C, D
Explanation
The correct answers highlight behaviors that are commonly associated with data loss or exfiltration, such as unexpected data transfers, usage of file transfer protocols to external destinations, and a sudden increase in encrypted traffic. These deviations from normal traffic profiles should raise flags for further investigation. Conversely, behavior that aligns with normal patterns or solely involves internal traffic does not typically indicate data loss.
- A. Correct.
Unexpected large data transfers during periods of low activity are a strong indicator of potential data exfiltration, especially from high-value assets like database servers.
- B. Incorrect.
Outbound traffic directed toward known internal IP addresses is normal behavior within a secure network and does not suggest data loss or exfiltration.
- C. Correct.
Traffic patterns matching known file transfer protocols, such as FTP or HTTP, going to external destinations could indicate unauthorized data transfer or exfiltration.
- D. Correct.
A sudden increase in encrypted traffic to an external destination is suspicious, as attackers often use encryption to hide the content of stolen data during exfiltration.
- E. Incorrect.
Normal traffic patterns with no anomalies or deviation from the baseline would not indicate potential data loss, as no unusual activity is observed.