The correct answer isA – Initiate the endpoint isolate action to contain the threat.

For incidents indicating possible remote compromise or unauthorized task creation, the most effective initial response isendpoint isolation. This cuts off the endpoint’s network access, preventing lateral movement and limiting attacker activity until further investigation and remediation.

“The endpoint isolate action is the primary containment step in incidents involving suspected remote compromise, halting network communication to reduce further risk.”

Document Reference:XSIAM Analyst ILT Lab Guide.pdf

Page:Page 40 (Incident Handling/SOC section)