Scenario: An employee left your company. You find out that they still have remote access to internal systems. What should be your immediate action?

A. Disable their accounts

B. Monitor their activities

C. Notify higher management

D. Change the internal system passwords

Answer:  A

Explanation:

• Disable their accounts: This should be the immediate action to cut off any potential unauthorized access.
• Monitor their activities: Monitoring is important, but the priority should be to immediately prevent any unauthorized access.
• Notify higher management: While it's crucial to keep management informed, the immediate concern should be to restrict unauthorized access.
• Change the internal system passwords: While this is a good long-term action, it might not prevent access through other means (like token-based authentication or SSH keys).