Analysts suspect a managed endpoint is actively communicating with an attacker. Which supported response action can help contain network communication while investigation continues?

1. Change only the device's display name
2. Isolate the device using the endpoint response capability
3. Add a retention label to unrelated email
4. Increase the endpoint's screen resolution