Which of the following activities would take place during the containment phase?

Disseminating change management documentation about steps taken during the incident is a post-incident activity that belongs in the Lessons Learned phase, after the incident is fully resolved.

Rebuilding a server from scratch using original installation media is an Eradication or Recovery phase task performed only after the threat has been removed and the environment is stable.

During containment, analysts must establish exactly what happened and how far the incident has spread before they can make accurate isolation decisions. Correlating firewall logs, IPS packet captures (PCAPs), and server syslogs together builds a timeline of attacker activity that directly informs which systems to quarantine, which communication paths to block, and what the full blast radius of the incident is - all actions central to the containment goal.

Creating a binary forensic image of an infected drive is an evidence-preservation step typically associated with the Identification or early Eradication phase, aimed at capturing disk state before remediation rather than actively limiting incident spread.