A confirmed incident affects a business-critical server. Responders need containment and a defensible record. Which TWO actions are appropriate? Select TWO.

1. Preserve relevant evidence and document the activity timeline
2. Use authorized containment steps proportionate to the incident and service impact
3. Publish sensitive incident artifacts publicly by default
4. Delete all logs before isolating the host