Exam CS0-001 topic 1 question 406 discussion

i agree

Rogue endpoint would suggest that the device is not supposed to be there.... There is less info to confirm that than there is to confirm data exfil... So I'd go with Data Exfil

From the Cybersecurity Analyst Certification Bundle: "A common approach to exfiltrating data is to first consolidate it in a staging location within the target network. Adversaries don’t want to duplicate efforts or exfiltration streams because such duplication would also make them easier to detect. Instead, they will typically coordinate activities within a compromised network. This means that even if multiple agents are searching for sensitive files in different subnets, they will tend to copy those files at the coordination hub at which they are staged, prepared, and relayed to an external repository. Unfortunately, these internal flows will usually be difficult to detect because they may resemble legitimate functions of the organization."