When a technician suspects prohibited activity on an organization’s network or computers,
which of the following is the FIRST step they should take?

A.
Confirm an actual infraction has taken place

B.
Confront the suspected person with incident details

C.
Notify others so that peers will stop the activity

D.
Erase the contents of the user’s computer and disable their account