CompTIA Security+ (SY0-701) SY0-701 — Question 60

An administrator was notified that a user logged in remotely after hours and copied large amounts of data to a personal device. Which of the following best describes the user’s activity?