CompTIA CySA+ CS0-003 Practice Question

Monitoring outbound traffic to detect large data transfers to external IP addresses is the most effective way to identify potential data exfiltration. This method directly tracks the data leaving the network, allowing security teams to identify and stop unauthorized transfers early. Other methods such as tracking internal network bandwidth usage, monitoring processor and memory usage on workstations, and logging and reviewing login times can indicate suspicious activity, but they do not specifically reveal data being transferred outside the network.