Nedved is an IT Security Manager of a bank in his country. One day. he found out that there is a security breach to his company's email server based on analysis of a suspicious connection from the ema

Leaving the compromised server connected and merely contacting the incident response team allows the breach to continue and potentially worsen, violating the principle of containment.

Blocking the connection at the firewall is a good partial containment measure, but disconnecting the server directly offers a more complete and immediate isolation, as other vectors or bypasses might exist.

Disconnecting the email server from the network is the most critical and immediate containment action to prevent further data exfiltration, lateral movement of the attacker, or further compromise of the system, before involving the incident response team for forensic analysis. This isolates the threat.

Migrating to a backup server does not address the ongoing compromise of the original email server and could potentially spread the infection if the backup is also connected or if the migration process is insecure.