Which actions are identified as possible containment or mitigation measures during Resolve? Select ALL that apply.

### Why this is right - **Disable connectivity to affected systems or devices** is correct because restricting connectivity can block a threat actor from causing further damage. - **Isolate systems and temporarily suspend employee access when necessary** is correct because the material identifies these as possible actions to detect and stop further intrusions. - **Preserve evidence and supporting documentation** is correct because records support analysis of the incident. ### The concept Containment aims to limit further harm while the team understands and resolves the issue. Connectivity restrictions and isolation are examples, not automatic actions for every situation. Suspending access may be necessary temporarily if it helps stop further intrusion. Evidence preservation serves analysis and documentation needs and should accompany response work. ### The other options - **D. Ignore discovered vulnerabilities once systems are restored**: This is incorrect because discovered vulnerabilities should be patched and devices updated. ### Terms - **Threat actor**: A person or group causing, or attempting to cause, harm through an incident. ### Remember Contain further harm, preserve useful records, and address vulnerabilities rather than leaving them open.