1. Scenario: You get a call from one of your clients headquartered in Rhode Island, how would you investigate a foreign IP from Greece making a successful connection to the client? 2. How would you determine if an email is phishing? One of your clients says they opened a .DOCM file and then determined the email looked suspicious. 3. Related to the previous questions, a couple weeks later there is an internal IP making a connection to an external IP that Intel reports have said is used for malicious purposes. How would you investigate?
