CompTIA A+ Core 2 (220-1002) — Question 393

Which of the following should be performed FIRST after discovering an employee is using a corporate laptop to steal trade secrets?

Answer options

• A. Disable the laptop
• B. Preserve the data
• C. Report the incident
• D. Track the evidence

Correct answer: C

Explanation

The correct answer is C, as reporting the incident is crucial to ensure proper protocols are followed and to initiate an investigation. Disabling the laptop or preserving data may be necessary later, but immediate reporting allows for a coordinated response. Tracking evidence is also important, but it comes after the initial report.