When a technician suspects prohibited activity on an organization's network or computers, which of the following is the FIRST step they should take?

Confirming the infraction ensures the technician has factual evidence before escalating, avoiding false accusations and ensuring any subsequent actions are legally and procedurally defensible. Acting on an unconfirmed suspicion could violate company policy, expose the organization to liability, or alert a malicious actor prematurely. Documenting confirmed evidence is also a critical step in proper incident response.

Directly confronting the suspected person before confirmation risks a false accusation, could destroy evidence, and bypasses the proper incident response chain of command.

Notifying peers instead of management or the security team is inappropriate, violates confidentiality, and does not follow a formal incident response procedure.

Erasing a user's computer and disabling their account is a drastic, irreversible action that destroys potential forensic evidence and must never be a first response to a suspicion.