220-1002 Question #103: Real Exam Question with Answer & Explanation

The correct answer is C: Immediately notify the local authorities or corporate security.. Upon discovering illegal software, the technician's immediate next step is to notify local authorities or corporate security. This is a potential legal matter that falls outside the technician's scope of authority - it requires proper law enforcement or security personnel involve

Question

A technician is dispatched to work on a computer that belonged to a recently terminated employee. The technician determines the system is hosting illegal software. Which of the following actions best describes the NEXT step the technician should take?

Options

ASecure the computer to establish chain of custody.
BBack up the computer data to an IT share.
CImmediately notify the local authorities or corporate security.
DReimage the computer for future use.

Explanation

Upon discovering illegal software, the technician's immediate next step is to notify local authorities or corporate security. This is a potential legal matter that falls outside the technician's scope of authority - it requires proper law enforcement or security personnel involvement. Taking any other action risks compromising a potential investigation. Backing up the data (B) or reimaging the computer (D) would destroy evidence, which could constitute obstruction. While establishing chain of custody (A) is an important forensic step, it should be directed and initiated by the appropriate authority - law enforcement or corporate security - not performed unilaterally by a technician. The technician should stop work, not touch the machine further, and escalate immediately.

Community Discussion

No community discussion yet for this question.

Full 220-1002 Practice