Question

An employee is terminated during a contentious meeting on Friday afternoon. The security team is notified 20 minutes before the meeting begins. Which action should be taken FIRST to reduce the risk of retaliation or data theft by this insider?

Accepted Answer

Disable the employee's user accounts and revoke active sessions at the scheduled meeting time

Answer

Schedule an account deletion job to run over the weekend during the maintenance window

Answer

Reset the employee's password and email the new credentials to their manager

Answer

Archive the employee's mailbox and home directory before taking any further action