Exercise 1: How This Chapter's Scope Differs From incident1's — Possible Solution
====================================================================

THE DIVIDING LINE PER THIS CHAPTER
------------------------------
Per this chapter, "incident1's own material picks up exactly where
this chapter leaves off" - incident1 covers "classification, severity,
and escalation," but "all of that starts from a ticket already
recognized as a security-relevant incident." This chapter covers "the
step before that: noticing that a given ticket even belongs in that
category in the first place."

WHY THIS IS A GENUINELY DIFFERENT SKILL, NOT JUST AN EARLIER STAGE OF
THE SAME ONE
------------------------------
incident1's skills (assigning a SEV level, deciding who to escalate
to, writing a good ticket) all assume the hard part - realizing
something is actually wrong - has already happened. This chapter's
skill is the opposite: taking something that looks completely
unremarkable and asking whether it might not be. These require
different instincts: incident1 is about process once alarm bells are
already ringing; this chapter is about noticing there should be alarm
bells at all.

WHY THE SYNC-BUG EXAMPLE BELONGS HERE, NOT IN incident1
------------------------------
At the moment the ticket arrives, nothing marks it as security-related
- it reads as an ordinary technical complaint ("email isn't syncing").
incident1's own tools (severity frameworks, escalation paths) have
nothing to act on yet, because nothing has been classified as an
incident. The actual content of this chapter's example - checking mail
rules, recognizing the forwarding-rule pattern - is exactly the
recognition step that has to happen before incident1's own material
becomes relevant at all.

WHERE THE HANDOFF ACTUALLY OCCURS
------------------------------
The moment the forwarding rule is found and recognized as suspicious,
the ticket crosses from this chapter's territory into incident1's -
that's precisely when classification and escalation (incident1's own
subject) become the next needed step, per this chapter's own warn-box
pointing toward Chapter 7 and, implicitly, incident1's process beyond
it.

WHY THIS WORKS AS AN ANSWER
------------------------------
It states the chapter's own dividing line, explains why recognition
and classification are genuinely different skills rather than stages
of the same one, and explains specifically why the sync-bug example
sits before the point where incident1's own material would take over.