Egress monitoring

Egress monitoring watches traffic leaving the network rather than entering it. The aim is to catch what inbound-facing controls never see: data exfiltration, command-and-control beacons calling home from compromised hosts, and outbound policy violations such as sensitive files heading to personal cloud storage. Techniques include inspecting outbound flows at the perimeter, alerting on unusual destinations or volumes, and data loss prevention tooling that recognises sensitive content on its way out.

The logic that decides questions: most monitoring effort historically faces inward, at what attackers send in, but every successful breach ends with something leaving, whether stolen data or a beacon to the attacker’s infrastructure. Outbound traffic is therefore where quiet compromises surface. Steady low-volume transfers to an unfamiliar host, DNS queries carrying encoded payloads, or traffic at odd hours are the signatures, and they are visible only if someone is looking outward. Egress alerts gain their meaning when correlated with other sources in a SIEM.

Exam relevance: if a scenario mentions detecting data exfiltration, spotting command-and-control callbacks, or monitoring outbound traffic, the answer is egress monitoring. The nearest confusable is DLP: DLP is a control that identifies and blocks sensitive content specifically, while egress monitoring is the broader practice of watching everything that leaves, including traffic DLP would never classify.