Which of the following can indicate a security incident?

• A. Regular software updates
• B. Unusual network traffic patterns
• C. Sufficient disk space
• D. Strong password usage

Answer: (B)

Unusual network traffic patterns can indicate a security incident because they show activity that deviates from normal operations, such as sudden spikes in data transfer, connections to unfamiliar or external destinations, or use of unexpected ports. These anomalies often point to malware infections, data exfiltration, or an attacker communicating with a command-and-control system. In healthcare IT, watching for such deviations helps detect breaches early, especially when correlated with logs and alerts from security systems.

Regular software updates reduce vulnerabilities but don’t themselves signal a problem. Sufficient disk space is a system health factor, not an incident indicator. Strong password usage reduces risk but is a preventive control rather than a sign of an active security event.