A managed workstation is actively communicating with a confirmed malicious destination. Responders must contain network spread while retaining Defender connectivity where supported. Which response fits?

1. Reimage immediately before evidence collection in every case
2. Delete the device inventory entry
3. Suppress the destination alert
4. Isolate the device through Defender for Endpoint