[Milla]

Not a bad answer. This is what i put.

"If an employee is engaged online in downloading unauthorized information, and I am the system admin, the first thing I would do is to drop his connection to the internet, stopping him from accessing the internet, and stopping the download. Than I would block the site or application. I would than immediately check the files he has downloaded, and run system scans on the network, and the computer to see if anything has been triggered, or if anything looks suspicious. For all I know the employee didn’t realize he was breaking policy, but no matter what you take no chances, you check everything for functionality to make sure everything is up and running still. Importantly, maintain proof, so the employee can be dealt with."