Joe an employee has reported to Ann a network technician an unusual device plugged into a USB port on a
workstation in the call center. Ann unplugs the workstation and brings it to the IT department where an incident
is opened. Which of the following should have been done first?
![PrepAway - Latest Free Exam Questions & Answers](https://www.briefmenow.org/img/pa5.jpg)
A.
Notify the incident response team lead
B.
Document chain of custody
C.
Take a copy of volatile memory
D.
Make an image of the hard drive