A workstation encrypts shared documents and displays a payment demand. Select 2 actions that directly reduce further damage and support recovery.

1. Isolate the affected workstation from networks
2. Reconnect all shares to inspect file names faster
3. Delete every security log immediately
4. Recover verified data from clean offline backups after containment
5. Pay immediately before evaluating backups