Which of the following should be done FIRST?

A user is suspected of engaging in prohibited activity on their workstation. Which of the following
should be done FIRST?

A.
Inform a supervisor or management.

B.
Disable network access for the user.

C.
Search the workstation for evidence.

D.
Call the authorities to question the user.

Explanation:

If you found out about your co worker, inform your supervisor or senior management and let them
handle the situation. You don’t need to interfere in the situation.