In reviewing the security logs for a company's headquarters in New York City, which of these activities should not raise much of a security concern?

A recently hired data scientist in the Medical Analytics department has repeatedly attempted to access the corporate financial database

One evening an employee logs in from home and downloads all of the files associated with the new product he is working on

An employee has started logging in from home for an hour or so during the last 2 weeks of each quarter

Each night one headquarters employee logs into his account from an ISP in China