A company suffered a critical incident where 30GB of data was exfiltrated from the corporate network. Which of the following actions is the most efficient way to identify where the system data was…

Question

Options

• AAnalyze firewall and network logs for large amounts of outbound traffic to external IP addresses
• BAnalyze IPS and IDS logs to find the IP addresses used by the attacker for reconnaissance
• CAnalyze endpoint and application logs to see whether file-sharing programs were running on the
• DAnalyze external vulnerability scans and automated reports to identify the systems the attacker

• A
  54% (25)
• B
  11% (5)
• C
  7% (3)
• D
  28% (13)

Explanation

Firewall and network logs are the most direct source for tracing data exfiltration because they capture all traffic crossing the network boundary, including the source IP (where data left from) and destination IP (where it was sent), along with traffic volume - making it straightforward to spot a 30GB outbound transfer to an external address.

Why the distractors are wrong:

• B is wrong because IPS/IDS logs focused on reconnaissance reveal how the attacker got in, not where data went out.
• C is wrong because endpoint/application logs showing file-sharing programs might indicate how data was staged, but don't reliably reveal the external destination.
• D is wrong because external vulnerability scans identify exploitable weaknesses, not exfiltration paths - they're a pre-attack tool, not a forensic one.

Memory tip: Think "data LEFT the network" → look at the boundary logs (firewall/network). Exfiltration is a network event, so network logs are always your first stop when tracking data leaving the organization.

No community discussion yet for this question.