During an incident investigation in Microsoft Defender XDR, a SOC analyst confirms that a single onboarded Windows workstation is actively communicating with a known command-and-control server. The analyst must immediately stop the device from spreading laterally to other endpoints while still allowing the security team to run investigation commands and collect forensic data from that device. Which response action should the analyst take from the device page in the Microsoft Defender portal?