Use the incident-response flowchart. After a student notices an unknown remote session on the team laptop, which sequence is best?