During the containment phase of incident response, a security analyst isolates an infected workstation from the network. Which action should be taken NEXT?
-
A
Wipe and reimage the system immediately
-
B
Preserve forensic evidence before any remediation
-
C
Notify all users about the breach
-
D
Restore from the most recent backup