Which of the following may be an indication of a possible system compromise?

Which of the following may be an indication of a possible system compromise?

A.
A port monitor utility shows that there are many connections to port 80 on the Internet facing web server.

B.
A performance monitor indicates a recent and ongoing drop in speed, disk space or memory utilization from the baseline.

C.
A protocol analyzer records a high number of UDP packets to a streaming media server on the Internet.

D.
The certificate for one of the web servers has expired and transactions on that server begins to drop rapidly.