A technician encounters prohibited materials on a computer located in a common area that
is used by several employees. Which of the following should be done FIRST?

A.
Remove the item from the computer

B.
Show to others so they can be a witness

C.
Copy the item to an external website

D.
Report the incident to management

Explanation:

http://en.wikipedia.org/wiki/Computer_security_incident_management