An attacker has breached multiple lines of information security defense. Which of the following BEST describes why delayed containment would be dangerous?

A.
The attacker could be blocked by the NIPS before enough forensic data can be collected.

B.
The attacker could erase all evidence of how they compromised the network.

C.
The attacker could cease all attack activities making forensics more difficult.

D.
The attacker could escalate unauthorized access or compromise other systems.