In the course of a detailed investigation into a potential breach, forensic analysts scrutinize the...

Option C is the strongest answer because the scenario describes frequent, high-volume outbound communications from an internal system to an untrusted external server , including large binary files that do not fit normal business workflows. CHFI v11 explicitly includes Indicators of Compromise (IoC) , Analyze Traffic to Detect Malware Activity , and Examine Data Exfiltration Attempts made through FTP under its network-forensics objectives.

These are classic signs of data exfiltration . The foreign destination, unusual data type, abnormal transfer volume, and deviation from standard operations all point toward unauthorized outbound movement of sensitive information. That is a more precise fit than failed connection attempts, off-hours logins, or reboot anomalies.

In CHFI terms, investigators use traffic analysis, log review, and event correlation to identify whether an internal host is behaving like a staging or exfiltration node. Since the question focuses on unexpected external communications and atypical outbound file transfers, the most accurate indicator of compromise is abnormal outbound traffic suggesting data exfiltration .