An engineer detects an intrusion event inside an organization's network and becomes aware that files that contain personal data have been accessed. Which action must be taken to contain this attack?

Disconnecting the affected server from the network is the primary containment technique defined in incident response frameworks because it immediately terminates the attacker's access channel, halts further data exfiltration, and prevents lateral movement to other systems. This action preserves the server state for forensic analysis while stopping active harm.

Analyzing the source is a detection and analysis activity, not a containment action; it does nothing to stop ongoing unauthorized access to personal data.

Accessing the server to verify encryption status is a forensic analysis step that delays containment and could alert an attacker who still has an active session.

Determining the attack surface is a scoping and analysis activity that should follow containment, not precede it when active data access is occurring.