Which of the following is the strongest indicator of exfiltration over non-standard channels?

• A. A sudden spike in CPU usage on a single server
• B. An increase in failed login attempts.
• C. Outbound traffic to known cloud services during business hours.
• D. Encrypted payloads being transmitted to unfamiliar endpoints.

Answer: (D)

The strongest signal of exfiltration over non-standard channels is encrypted payloads being transmitted to unfamiliar endpoints. This combination directly points to data leaving your network: the payloads are hidden by encryption so content inspection is less effective, and the destinations are not part of normal, approved operations, indicating a covert data transfer to an external host. In contrast, a spike in CPU usage can have many benign causes, failed login attempts relate to access control rather than data leaving the network, and outbound traffic to known cloud services during business hours may be legitimate or obvious but doesn’t necessarily imply a non-standard exfiltration channel.