CompTIA CySA+ (CS0-003) — Question 488

Joe, a leading sales person at an organization, has announced on social media that he is leaving his current role to start a new company that will compete with his current employer. Joe is soliciting his current employer's customers. However, Joe has not resigned or discussed this with his current supervisor yet. Which of the following would be the best action for the incident response team to recommend?

Answer options

• A. Isolate Joe's PC from the network
• B. Reimage the PC based on standard operating procedures
• C. Initiate a remote wipe of Joe's PC using mobile device management
• D. Perform no action until HR or legal counsel advises on next steps

Correct answer: D

Explanation

The best course of action is to perform no action until HR or legal counsel advises on next steps since Joe has not formally resigned and legal implications may arise from any premature actions. Isolating Joe's PC or wiping it could escalate the situation without proper authority. Reimaging the PC would also be unnecessary without a clear directive from HR or legal.