The correct answer is B because reverting to the last known secure build is the most appropriate containment action when a security incident affects a continuous integration and continuous delivery pipeline. A compromised or insecure build can introduce malicious code, vulnerable components, configuration weaknesses, or unauthorized changes into downstream environments. Reverting to a known secure build helps stop propagation of the compromised version while preserving business continuity as much as possible.
Disabling all developer accounts is excessive unless there is evidence that all accounts are compromised, and it could unnecessarily disrupt operations. Disabling the production environment may create significant business impact and may not be necessary for containment. Increasing logging can support investigation, but it does not contain the incident. CISM incident management emphasizes selecting containment actions that limit damage while considering business impact. In a CI/CD pipeline incident, restoring or reverting to a trusted build is the best containment action among the options.
Reference: CISM Information Security Incident Management; incident containment, secure DevOps, CI/CD pipeline security, and business impact reduction.