A security operations analyst is reviewing network traffic baselines for nightly database backups. Given the following information: Which of the following should the security analyst do next?

The correct answer is C. Refer to the incident response playbook for the proper response. The unexpected 97GB data transfer to an external IP (85.34.17.98) at an unusual time (12:46 a.m.) is a strong indicator of potential data exfiltration. The appropriate next step is to follow the incident response playbook to ensure a structured and compliant response.

Submitted by krish.m· Mar 6, 2026Security Operations

Question

A security operations analyst is reviewing network traffic baselines for nightly database backups. Given the following information:

Which of the following should the security analyst do next?

Exhibits

Options

AConsult with a network engineer to determine the impact of bandwidth usage.
BQuarantine PRDDB01 and then alert the database engineers.
CRefer to the incident response playbook for the proper response.
DReview all the network logs for further data exfiltration.

How the community answered

(47 responses)

A
13% (6)
B
2% (1)
C
81% (38)
D
4% (2)

Explanation

The unexpected 97GB data transfer to an external IP (85.34.17.98) at an unusual time (12:46 a.m.) is a strong indicator of potential data exfiltration. The appropriate next step is to follow the incident response playbook to ensure a structured and compliant response.

Community Discussion

No community discussion yet for this question.

Full CAS-005 Practice