A security analyst is configuring a SIEM to detect potential data exfiltration. Which combination of data sources and correlation logic is most effective for this use case?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because data exfiltration detection requires correlating multiple signals: DLP alerts indicating sensitive data movement, large outbound transfers visible in proxy/firewall logs, and anomalous access timing to data repositories; no single source provides complete coverage, but their combination creates a high-confidence exfiltration indicator. A is wrong because failed logins and badge swipes correlate to physical access anomalies (tailgating, after-hours entry), not data exfiltration.
Full explanation below image
Full Explanation
B is correct because data exfiltration detection requires correlating multiple signals: DLP alerts indicating sensitive data movement, large outbound transfers visible in proxy/firewall logs, and anomalous access timing to data repositories; no single source provides complete coverage, but their combination creates a high-confidence exfiltration indicator. A is wrong because failed logins and badge swipes correlate to physical access anomalies (tailgating, after-hours entry), not data exfiltration. C is wrong because AV detections with patch compliance reveals malware prevalence on unpatched systems, not data movement. D is wrong because network bandwidth and UPS statistics are operational metrics; they do not identify what data was transferred or to where.