Security Monitoring →hardMultiple ChoiceObjective-mapped

200-201 Security Monitoring Practice Question

A SOC analyst is analyzing NetFlow data and notices a sudden spike in outbound traffic from a single internal host to an external IP address during non-business hours. The traffic volume is significantly higher than the baseline. Which suspicion is most likely?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Data exfiltration is occurring

A sudden increase in outbound traffic to a single external IP, especially outside business hours, often indicates data exfiltration.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The host is running a backup to cloud storage
Why it's wrong here
Backups typically occur during scheduled times and to known IPs.
✗
The host is part of a botnet performing DDoS attack
Why it's wrong here
DDoS attacks generate high outbound traffic but often to multiple targets.
✓
Data exfiltration is occurring
Why this is correct
Unusual high-volume outbound traffic to a single destination is a classic exfiltration sign.
✗
The host is performing legitimate software updates
Why it's wrong here
Updates typically occur during business hours and from multiple sources.

Go deeper

200-201 Security Monitoring Practice Question

Why each option matters

Option-by-option breakdown

Related to this question