Large night-time uploads leave the health-clinic file share for an unknown S3 bucket. Which term names that activity?
Select an answer to reveal the explanation.
Short Explanation
The clinic file share is quietly shipping boxes to a stranger's S3 dock after hours. Data leaving without permission is exfiltration. Busy WAN is a symptom, not DDoS, and S3 is not the Windows registry.
Full Explanation
Large night-time uploads leaving the health-clinic file share for an unknown S3 bucket are exfiltration, because unauthorized civic data is leaving the environment. The clinic share is shipping boxes to a stranger's cloud dock after hours, which is a confidentiality and data-loss event for possible ePHI. Busy WAN is a symptom of transfer volume, not proof of DDoS, and S3 is cloud object storage—not the Windows registry.
Calling it ransomware because any large night-time file activity is encryption fails by concept: outbound copy to S3 is data leaving, not encrypt-in-place for ransom. Calling it DDoS because the clinic WAN link is busy fails by concept: saturation from upload is not the attack class described. Calling it registry persistence because S3 is a Windows configuration hive fails by concept: S3 is not Windows registry storage.
Exam caveat: Unauthorized outbound transfer of civic data equals exfiltration.
Operational check: Block the destination, identify accounts and hosts performing the uploads, preserve file-share and proxy logs in ES, notify privacy and compliance for possible ePHI exposure, and tune detections for large after-hours transfers to unsanctioned cloud endpoints.