CompTIA A+ Core 2 (220-1202), Domain 4, Objective 4.6 focuses on prohibited content and prohibited activity, incident response, and the proper handling of an event once it is discovered. Incident response is the disciplined, repeatable process a technician follows the moment they encounter something that violates policy or the law — illegal content, evidence of an attack, a data breach, or misuse of company resources. On the exam and in the field, the difference between a good outcome and a catastrophe is almost never technical skill; it is whether you followed the correct order of steps and documented everything.
In this article you will learn what counts as an incident, how to identify and report it through the proper channels, why you must preserve both the data and the device without altering them, and how thorough documentation protects you, your employer, and any future investigation.
What Counts as an Incident
An incident is any event that violates security policy, acceptable use policy, or the law, or that threatens the confidentiality, integrity, or availability of systems and data. For the purposes of Objective 4.6, incidents frequently involve prohibited content or prohibited activity. Common examples a help-desk technician may stumble onto include:
- Illegal material such as child sexual abuse imagery, stolen intellectual property, or pirated software.
- Malware infections, ransomware notes, or evidence of an active network intrusion.
- A data breach exposing regulated data such as PII, PHI, or credit-card numbers.
- Employee misconduct: harassment, threats, embezzlement, or exfiltration of company data to a personal account.
- Violations of the Acceptable Use Policy (AUP), such as running a business on company equipment or accessing prohibited sites.
You do not have to prove wrongdoing. Your job as first responder is to recognize that something is wrong and to hand it off correctly. Trying to investigate, confront, or “clean up” the situation yourself almost always makes things worse and can destroy evidence or expose you to legal risk.