A security analyst is investigating a potential data exfiltration via an AI chatbot. The analyst suspects a user is using the chatbot to extract information from an internal knowledge base by crafting specific questions. Which Microsoft Sentinel hunting query would best identify this behavior?

A is correct because data exfiltration via AI chatbot typically manifests as a pattern where users send targeted questions (low token input) and receive large amounts of retrieved knowledge base content (high token output). Hunting for sessions where the response-to-request token ratio is anomalously high across multiple queries from the same user is the most semantically appropriate indicator of systematic information extraction. B is incorrect because SQL injection patterns indicate a different attack type, not data exfiltration through legitimate question answering. C is incorrect because high query volume alone does not distinguish legitimate heavy users from exfiltration. D is incorrect because external IP addresses may indicate unauthorized access but not specifically chatbot-based data exfiltration.