Exam CS0-003 topic 1 question 248 discussion

A. Data exfiltration Explanation: Protocol violation alerts on external firewall: This might indicate attempts to bypass security controls to establish a connection to an external location or to set up a covert channel. Unauthorized internal scanning activity: This suggests that the threat actor is mapping the network to find valuable data or vulnerable systems. Changes in outbound network performance: This could indicate large amounts of data being transferred out of the network, which is typical of data exfiltration activities. These steps collectively align with a threat actor's goal of identifying valuable data and then exfiltrating it out of the network, often while trying to remain undetected.

Answer would be A: Data exfiltration