A CAD workstation used for public-works drawings is confirmed malware-infected. Which mitigation contains the host while still supporting investigation?
Select an answer to reveal the explanation.
Short Explanation
Pull the network cable (logically or physically) but do not smash the drive yet. Isolation stops the spread while you still have evidence to examine—contain first, then investigate cleanly.
Full Explanation
Isolation removes a compromised host from productive networks to limit lateral movement while preserving volatile and disk evidence for analysis. Immediate destruction without capture, placing the host on sensitive OT segments, or publicly sharing samples before containment undermines both security and investigative value.