During an investigation a security analyst discovers traffic going out to a command-and-control server. The analyst must find out if any data exfiltration has occurred. Which of the following would best help the analyst determine this?

Application logs record events related to specific applications, such as authentication attempts, errors, or user actions. While useful for understanding application activity, they generally do not provide enough visibility into outbound network traffic to confirm whether data was exfiltrated.

Metadata provides information about files or communications, such as timestamps, ownership, or file size. Although metadata may help support an investigation, it does not contain the actual network communication details needed to determine whether data was transferred to an external system.

Network logs can show connections between systems, including source and destination IP addresses, ports, and traffic patterns. They are useful for identifying suspicious outbound communication, but they usually do not contain the full packet contents necessary to verify exactly what data, if any, was exfiltrated.