Which of the following can be an indicator of a compromised device?

A compromised device often exhibits unusual behavior that deviates from normal operations. Unusual data usage patterns can serve as a significant indicator of such a compromise. For instance, if a device suddenly begins sending or receiving large amounts of data without a clear reason, it may indicate that malware is active, transmitting data to a remote server, or being utilized for unauthorized activities like participating in a distributed denial-of-service (DDoS) attack.

Frequent app updates, while sometimes indicative of a well-maintained device, do not inherently signify a compromise; legitimate software frequently updates to enhance security and functionality. Similarly, connecting to a VPN is a common activity for users seeking secure and private internet access, and while a compromised device could potentially connect to a rogue VPN, it is not a definitive indicator on its own. Regular software downloads may also occur for a variety of benign reasons, such as updates or user-initiated installations, and thus do not necessarily indicate a compromise.

In summary, unusual data usage patterns stand out as a clear sign of a device that may have been compromised, signifying potential malicious activity or unauthorized access.