Which of the following is the BEST indicator of a successful external intrusion into computer systems?

A. Unexpected use of protocols within the DMZ.
B. Unexpected increase of malformed URLs.
C. Decrease in the number of login failures.
D. Spikes in the number of login failures.