Record the incident details and escalate the case to your manager is the correct action to take next.

Record the incident details and escalate the case to your manager preserves a clear record of what you observed and ensures that the incident is handled through the proper channels for legal, HR, and compliance review. Escalation allows coordinated triage so that evidence is collected correctly and chain of custody is maintained. It also prevents unilateral actions that could compromise an investigation or violate policy.

Run a focused audit of the employee's recent account activity with security logs is not the best immediate next step on its own because targeted auditing can and should be performed as part of a formal investigation. You should document and escalate first so that any log reviews are authorized and their results are admissible and preserved under the incident handling process.

Suspend the employee account immediately is not appropriate as an automatic next step because suspension may alert the employee and risk destruction of evidence or disruption of business operations. Account suspension can be warranted later after escalation and consultation with management and HR when there is authorization and a clear plan.

Meet with the employee to ask why they accessed the data is not the correct immediate action because confronting the employee can compromise the investigation and affect witness statements. Interviews should be conducted under guidance from management and HR and after evidence has been preserved.

Full AWS Practitioner Certification Question