When looking at aggregated logs$,$ you are seeing a large percentage of Windows hosts connecting to an Internet Protocol $($IP$)$ address outside the network in a foreign country. Why might this be worth investigating more closely?

$1$ point

It can indicate a malware infection

It can indicate log normalization

It can indicate what software is on the binary whitelist

It can indicate ACLs are not configured correctly