A security analyst, Ann, states that she believes Internet facing file transfer servers are being attacked. Which of the following is evidence that would aid Ann in making a case to management that…

A list of connecting IP addresses and geolocations provides context but does not by itself demonstrate malicious behavior or prove the servers are under attack.

Setting up future alerting thresholds is a remediation step, not evidence of an ongoing or past attack that can be presented to management.

Raw file transfer logs show what happened but without a baseline for comparison they cannot distinguish abnormal attack traffic from normal high-volume usage.

A baseline represents the established normal traffic and usage patterns for the file transfer servers - comparing current activity to that baseline objectively highlights anomalies such as unusual connection volumes, transfer sizes, or timing that indicate an active attack. This approach transforms subjective concern into measurable, documentable evidence that management can evaluate and act upon.