Option C is the best answer because CHFI v11 emphasizes the Role of Threat Intelligence in Computer Forensics , Indicators of Compromise (IoC) , and the analysis of firewall and network logs during attack investigations. When an unfamiliar external IP appears repeatedly in blocked inbound attempts, one of the most useful next steps is to determine whether that address is linked to known malicious infrastructure or threat intelligence feeds.
Checking threat-intelligence associations helps the investigator decide whether the activity is likely part of a broader intrusion campaign, commodity scanning, botnet behavior, or a known hostile source. That is more directly useful than checking firewall health, which does not address the source's intent. Looking for prior successful logins from the same IP may be helpful later, but it is less immediate than determining whether the IP is already known to be suspicious. Logging all traffic for the future is good practice, but it does not answer the present investigative question.
Therefore, under CHFI's network-forensics and threat-intelligence principles, Linda should next verify whether the source IP is associated with known threat intelligence sources .