An attacker exfiltrates data from a compromised host in HTTPS POSTs to a newly registered domain that mimics a SaaS vendor. The firewall allows the traffic because it is encrypted on port 443. Which combination best improves detection?

HTTPS exfiltration hides data inside encrypted sessions that look like ordinary web traffic. Two complementary approaches restore visibility. TLS decryption on the firewall or secure web gateway allows content inspection, DLP and file analysis on the decrypted payload, subject to privacy exclusions. Destination and behavior analytics work even without decryption: newly registered or low-reputation domains, lookalike names, unusual upload-to-download ratios and large or regular outbound volumes are strong indicators. Using both covers cases where decryption is not permitted. Blocking all outbound TCP 443 except internal destinations would break nearly every SaaS and web workflow, so it is not a realistic detection measure. A valid TLS certificate proves only that the domain owner obtained one; domain-validated certificates are available quickly and freely, so they are not evidence of legitimacy. Allowlisting the real vendor's domain does nothing to the lookalike domain the attacker is using and does not improve detection. Exam caveat: TLS 1.3 and certificate pinning can limit decryption for some applications, so analytics remain essential. Operational check: search proxy or firewall logs for the host's outbound byte counts by destination and confirm the lookalike domain is now categorized and blocked.