CompTIA A+ Core 2 (220-1202)Operational ProceduresHard
While repairing a workstation, a technician discovers files that appear to violate company acceptable use policy and may involve illegal content. Which of the following actions is MOST appropriate?
- AContinue the repair and ignore the discovered files
- BCopy the files to a personal USB drive for further review
- CDelete the files immediately to prevent further policy violations
- DPreserve the evidence, document the findings, and escalate to appropriate personnel following proper chain-of-custody procedures
Show answer & explanationAnswer & explanation
Correct answer: D. Preserve the evidence, document the findings, and escalate to appropriate personnel following proper chain-of-custody procedures
When potentially illegal or policy-violating content is discovered, technicians must preserve evidence intact, document what was found, and escalate through proper channels while maintaining chain of custody to support any investigation. Deleting, ignoring, or personally copying the files could destroy evidence or create legal liability.
Why the other options are wrong
- A. Ignoring the discovery fails the technician's obligation to report suspected violations.
- B. Copying files to a personal device breaks chain of custody and may create legal exposure for the technician.
- C. Deleting evidence could obstruct an investigation and violate legal requirements.
Chain of Custody
A documented process that tracks the handling, control, and transfer of evidence to maintain its integrity for legal or investigative purposes.
- Evidence must not be altered or transferred outside authorized channels
- Proper documentation includes who, what, when, and how evidence was handled
- Failure to maintain chain of custody can invalidate evidence in legal proceedings
Memory trick: Don't touch, just track — preserve and report.