intro
You are the technical security architect for Meridian Health Analytics, a mid-sized healthcare data analytics firm. Several internal systems running a third-party vendor's monitoring agent have triggered unusual outbound DNS activity shortly after a routine, digitally-signed software update. An initial assessment (attached below) concludes the activity is likely benign vendor telemetry. Most of this exercise is about designing the technical architecture response — the assessment critique is just the trigger for that design work.
How do you want to begin?