What is the next step in handling the incident?

A SIEM tool fires an alert about a VPN connection attempt from an unusual location. The incident response team validates that an attacker has installed a remote access tool on a user’s laptop while traveling. The attacker has the user’s credentials and is attempting to connect to the network.

What is the next step in handling the incident?
A . Block the source IP from the firewall
B . Perform an antivirus scan on the laptop
C . Identify systems or services at risk
D . Identify lateral movement

Answer: C