The correct answer is Isolation. The first action in a containment strategy is to isolate affected systems to prevent the malware from spreading to other systems or the network. Isolation can involve disconnecting the system from the network, disabling certain features, or placing the system in quarantine. While eradication and recovery are important steps, they only occur after the threat has been successfully contained. Re-imaging is a form of eradication and is not the immediate first action, as it would involve significant downtime without confirming the extent of the damage. Scope needs to be determined beforehand to isolate effectively but is not an action in itself.