At a logistics hub, the label printer normally has a flat small-flow profile and suddenly matches the file server's outbound pattern. Which host should the analyst pull first?
Select an answer to reveal the explanation.
Short Explanation
If the label printer starts talking like the file server, you pull the printer, the one whose habits just broke. Your baseline said that printer was a small, flat flow, and the new pattern is the anomaly. The trap is grabbing the file server just for being large, or the DNS server, or the badge reader.
Full Explanation
A traffic profile is useful when a host leaves its own baseline. The label printer normally has a flat, small flow. It now matches the file server's outbound pattern, so the printer is the host whose profile broke and the host to pull first. The choice is "The label printer, the host whose flat small-flow profile just broke and now matches the file server". The file server showing a large pattern can be that server's ordinary behavior. Size alone is not theft, so "The file server, on the view that a large outbound pattern from that server is data theft" fails. The DNS server is used by the whole hub for name lookups. Its ordinary role is not the profile that changed, so "The DNS server that every host at the hub already uses for ordinary name lookups" fails. The badge reader is not described as matching the file server, so "The badge reader on the dock door, a host that does not share this outbound pattern" fails. Exam caveat: a profile break is the reason to pull the printer first, and it is not yet proof of what left the host. Operational check: compare the printer's new destinations and session shape with its small-flow baseline before treating the file server's usual pattern as the lead.