Module 1 challenge — Question 4

A cybersecurity specialist detects suspicious activities in a company account, indicating a possible security breach. They use the NIST incident response lifecycle to respond to the security issue. How should the cybersecurity specialist use identity and access management (IAM) features during the Containment phase of the NIST incident response lifecycle?