A technician received a call stating that all files in a user's documents folder appear to be changed, and each of the files now has a .lock file extension. Which of the following actions is the…

Running a live disk clone is a forensic preservation step that is useful later but does not stop the active spread of ransomware.

Running a full antivirus scan is a remediation step that comes after containment; scanning while ransomware is active may not stop lateral movement.

Renaming files with a batch script does not remove the ransomware or decrypt the files; it addresses a symptom rather than the active threat.

Disconnecting the machine from the network is the first containment step because active ransomware can propagate laterally across network shares and other connected systems. Isolation stops the encryption process from affecting additional files and prevents communication with command-and-control servers. This preserves the environment for subsequent investigation and remediation.