After closing, a retailer store PC that usually talks only to two payment hosts starts a large steady flow to a new address. What does that traffic profile suggest?
Select an answer to reveal the explanation.
Short Explanation
A cash register that suddenly trucks boxes to a stranger's warehouse is not performing a routine update. You should treat that new, steady outbound flow as possible data loss and investigate that store PC. The trap is calling every outbound flow an update, a denial of service against the store, or a certificate expiry.
Full Explanation
The store PC normally speaks only to two payment hosts. After closing it opens a large steady flow to a new address. That departure from the host profile suggests data leaving the PC, and the next step is to investigate that host. No byte cutoff is required for the reading. The profile suggests "Possible data loss from that store PC, so the host should be investigated further". Treating every outbound flow as maintenance is not a profile rule, so "A normal software update, on the view that any outbound flow after closing is an update" fails. A denial of service against the store would be traffic aimed at the store. This flow leaves the store PC toward a new address, so "A denial of service aimed at the store, with the new flow as the attack on the shop" fails. Certificate expiry produces handshake failures to the usual hosts. It does not by itself explain a large steady transfer to a new address, so "A certificate expiry on the payment hosts that forces the PC to a replacement address" fails. Exam caveat: the new flow is a lead for possible data loss, not proof of the file that left. Operational check: identify the new destination and review that store PC, and do not wait for a byte threshold that the profile never defined.