During an incident response, what is the BEST method to isolate a compromised system to prevent lateral movement while maintaining evidence for analysis?
Shut down the system to cut off all processes
Disconnect the network interface card (NIC) from the network
Log off any users and wait for further instructions
Reimage the system to a known good state