To detect data exfiltration over non-standard channels, which indicator is most relevant?

• A. Unusual outbound traffic patterns
• B. Increased inbound login attempts
• C. Regular data backups
• D. Idle system timeouts

Answer: (A)

Spotting data exfiltration over non-standard channels relies on noticing anomalies in outbound data flows. When data is being stolen, it often travels to external destinations that aren’t part of normal operations, sometimes at unusual times, in unexpected volumes, or using nonstandard ports or protocols. This pattern—unusual outbound traffic to unfamiliar endpoints—is the clearest sign that data is leaving the network in a way that could be hidden from typical monitoring. The other indicators don’t fit the scenario as directly: more inbound login attempts point to potential credential access but don’t show data leaving the environment; regular data backups are expected operational tasks and don’t by themselves indicate exfiltration; idle system timeouts don’t reflect outbound data activity.