OmegaTech Corp identified unauthorized remote access to its primary server and data exfiltration tunnels.

ECIH prioritizes containment of the most critical threat vector. The primary server actively exfiltrating data represents the highest risk.

Option B is correct because isolating the primary server immediately stops data loss and attacker control. IoT remediation can follow once core assets are secured.

Options A and D delay containment. Option C causes unnecessary disruption.

ECIH stresses that responders must address the most damaging threat first, making Option B correct.