Need answer for the question asked in interview

I work in email and malware analysis project of US based Mssp. I have no experience in SOC/IR. So in one interview, they asked a question "Assume your organisation do not have EDR and SIEM tools, only a firewall. One endpoint is infected by a ransomware and constantly communicates with its C2s. How will you find out that one infected endpoint in firewall ?" submitted by /u/Terminator996
[link] [comments]


http://dlvr.it/T6QS21