A company suffered a critical incident where 30GB of data was exfiltrated from the corporate network. Which of the following actions is the most efficient way to identify where the system data was exfiltrated from and what location the attacker sent the data to?

Analyzing firewall and network logs is the most efficient way because they directly record outbound connections, including destination IP addresses and data volume. This allows you to pinpoint the source system within your network and the external location where the 30GB of data was sent. IPS/IDS logs primarily focus on detecting intrusions and reconnaissance, not necessarily the exfiltration itself or the destination. Endpoint/application logs might show file-sharing activity but won't definitively link it to the specific 30GB exfiltration or its external destination. Vulnerability scan reports identify potential weaknesses, not actual data exfiltration events or their pathways.