312-39V2: Certified SOC Analyst v2

At 10:30 AM, during routine monitoring, the SOC’s Tier-1 analyst Jennifer identifies unusual network traffic and confirms an active LockBit ransomware infection targeting finance-department systems. She escalates the incident to the SOC lead, Sarah, who activates the Incident Response Team (IRT) and directs the network team to isolate the finance department’s VLAN to prevent further spread across the network. Which phase of the Incident Response process is now being implemented?