Which of the following actions should a systems administrator perform during the containment phase of a security incident in the cloud?

A. Deploy a new instance using a known-good base image.
B. Configure a firewall rule to block the traffic on the affected instance.
C. Perform a forensic analysis of the affected instance.
D. Conduct a tabletop exercise involving developers and systems administrators.