During a security incident on an IaaS platform, which of the following actions will a systems administrator most likely take as part of the containment procedure?

Connecting to the instance for triage is an investigation and analysis step, not containment; it does not restrict the incident from spreading.

Adding a deny rule to the network ACL is a containment action because it instantly blocks inbound and outbound traffic for the affected instance, preventing lateral movement within the environment and halting potential data exfiltration. Network ACLs on IaaS platforms operate at the subnet level and can be updated rapidly without requiring direct access to the compromised instance, making this the fastest and safest containment step.

Mirroring traffic to perform a capture is a forensic analysis technique used to understand attack behavior, not a measure that stops or contains the incident.

Memory acquisition is a digital forensics procedure performed during the analysis phase to preserve volatile evidence, not a containment action.