Which of the following should a technician do FIRST to secure a mobile device?

A passcode establishes the primary access control barrier on a mobile device, blocking all unauthorized use before any other security measure can be relevant. Without it, any physical possession of the device grants full access. All subsequent security steps assume this baseline is in place.

Downloading updates improves security posture but is ineffective if the device has no access control preventing unauthorized users from using or modifying it.

Disabling GPS addresses location privacy, not device access control, and is not a primary security hardening step.

Installing antivirus adds malware protection but is a secondary control - it does not prevent unauthorized physical access to the device.