A security analyst observed the following activities in chronological order: 1. Protocol violation alerts on external firewall 2. Unauthorized internal scanning activity 3. Changes in outbound…

Data exfiltration involves unauthorized transfer of data out of a network. Protocol violation alerts and internal scanning suggest initial compromise and reconnaissance, while changes in outbound network performance (e.g., increased traffic) are a common indicator of large volumes of data being sent externally, consistent with data theft.

While data exfiltration can cause unusual traffic spikes, 'Unusual traffic spikes' is a symptom, not the ultimate goal of a threat actor in this context; data exfiltration describes the attacker's objective.

Rogue devices might be used for compromise or data theft, but the observed activities (protocol violations, scanning, outbound performance changes) directly point to data movement rather than just the presence of an unauthorized device.

Irregular peer-to-peer communication might occur, but it is too specific and does not encompass the broader implications of protocol violations, internal scanning, and significant outbound network performance changes that suggest a goal of data theft.