A user is suspected of engaging in prohibited activity on their workstation. Which of the following
should be done FIRST?
A.
Inform a supervisor or management.
B.
Disable network access for the user.
C.
Search the workstation for evidence.
D.
Call the authorities to question the user.