Which among the following actions should a first responder take when an incident occurs in an organization? A. Allow users to work on the suspected device.
B. Disable virus protection on the suspected device.
C. Change the state of the suspected device.
D. Start an investigation as soon as possible.
The correct answer is D. Start an investigation as soon as possible.
Explanation: When an incident occurs in an organization, the first responder should prioritize understanding the situation by starting an investigation. This helps in assessing the severity of the incident, determining the appropriate response, and mitigating any potential damages. Allowing users to work on the suspected device or modifying its state could interfere with evidence collection and analysis, while disabling virus protection would compromise security further.