Runtime alerts show suspicious outbound connections from one workload. The response team has identified its controller and has an approved containment plan. What is the best immediate approach?

1. Preserve relevant evidence and isolate the affected workload using tested controls
2. Assume the image tag proves the workload is safe
3. Publish the workload's credentials to ask for help
4. Delete every cluster log before investigating