The lead engineer in the Scada Support Lab found her system displaying an image stating that all files are encrypted and payment for the encryption key must be made within $48$ hours. Since Sifers$-$Grayson does not have its own Incident Response Team, Nofsinger Consultants were tasked to deploy an IH&R team to investigate and resolve the problems. After validating the malware incident, the Nofsinger team needs to focus on containing the threat. Which of the following is the first step that the Nofsinger IH&R team should take?

Start analysis of the compromised host to find malware signature, pattern, or behavior that you can use to contain the incident.

Block all unnecessary ports at the host and firewall.

Separate the compromised hosts from the operational network.

Gather and analyze network logs of the system to find the events of malware propagation through shared files and connected systems.