Which of the following does the guide NOT list among its criteria for choosing a containment strategy?

1. Section 3.3.1 gives a closed list of six criteria, so this can be settled by elimination. 2. The six are: potential damage to and theft of resources need for evidence preservation service availability time and resources needed to implement the strategy effectiveness of the strategy and duration of the solution. 3. Evidence preservation, duration of the solution and effectiveness of the strategy are all on that list, so none of them can be the answer. 4. The attacker's country of origin appears nowhere in the criteria. Attribution is discussed separately in section 3.3.3 on identifying attacking hosts, and it is treated as a distraction from containment rather than an input to it. 5. The reason the list is worth knowing is given in the same section: containment decisions "are much easier to make if there are predetermined strategies and procedures", and organizations "should create separate containment strategies for each major incident type, with criteria documented clearly". _Source: NIST SP 800-61 Rev. 2 "Computer Security Incident Handling Guide" (Aug 2012), section 3.3.1 "Choosing a Containment Strategy"_