Which of the following is a common network-based indicator of compromise (IOC) during a breach?

• A. Increased file read errors on user workstations
• B. Normal DNS traffic patterns
• C. Frequent software license check failures
• D. Unusual outbound connections

Answer: (D)

The main idea here is that breaches often reveal themselves through patterns in network traffic. Unusual outbound connections are a telltale network-based indicator of compromise because attackers who gain a foothold typically need to reach external command-and-control servers or siphon data out of the environment. You’d look for destinations that are unfamiliar or not aligned with the organization’s normal operations, new or uncommon ports, sudden spikes in outbound activity, or connections occurring at odd times. Security tools like firewalls, proxies, DNS logs, and NetFlow are designed to surface these anomalies, making this type of signal a strong red flag for breach activity.

The other options describe issues that aren’t typically network-based signs of intrusion. Increased file read errors on workstations point to local system or storage problems rather than external communication; normal DNS traffic patterns suggest no unusual domain activity, which wouldn’t indicate compromise; and frequent software license check failures relate to asset management or licensing rather than an external connection to control or exfiltrate data.