CompTIA Security+ (SY0-501) — Question 99

A Chief Information Security Officer (CISO) has tasked a security analyst with assessing the security posture of an organization and which internal factors would contribute to a security compromise. The analyst performs a walk-through of the organization and discovers there are multiple instances of unlabeled optical media on office desks. Employees in the vicinity either do not claim ownership or disavow any knowledge concerning who owns the media. Which of the following is the MOST immediate action to be taken?

Answer options

• A. Confiscate the media and dispose of it in a secure manner as per company policy.
• B. Confiscate the media, insert it into a computer, find out what is on the disc, and then label it and return it to where it was found.
• C. Confiscate the media and wait for the owner to claim it. If it is not claimed within one month, shred it.
• D. Confiscate the media, insert it into a computer, make a copy of the disc, and then return the original to where it was found.

Correct answer: A

Explanation

The most immediate action is to confiscate the media and dispose of it securely according to company policy, as it mitigates the risk of potential data breaches. The other options involve interacting with unknown media, which could pose a security threat by exposing the system to malicious content or data. Waiting for ownership claims or copying the media also introduces unnecessary risks.