In response to a USB drive found in the parking lot, what is the BEST immediate action for security?

• A. Plug it into a test machine to inspect contents
• B. Hand over to IT department for safe examination
• C. Copy contents to your personal device to inspect
• D. Ignore it and continue working

Answer: (B)

Unknown USB drives can be malware carriers or used for data exfiltration, so the safest immediate action is to hand it to the IT or security department for safe examination. They can analyze the device in isolated, controlled environments, scan for threats, and preserve evidence without risking endpoints or the network. Plugging it into a test machine or copying its contents to a personal device could trigger malware or expose sensitive data, and ignoring it could miss a valid threat. Reporting it to IT ensures proper containment and a proper investigation.