A security team enables GuardDuty Lambda Protection across their organization. GuardDuty raises a finding indicating one of the company's Lambda functions is generating network traffic to a known cryptomining domain. The function is triggered by an SQS queue that processes customer uploads. The team must contain the threat quickly while preserving the ability to investigate how the function was compromised. Which action best achieves immediate containment with minimal disruption to unrelated workloads?