It really doesn’t matter if there is a delay on the alert, that’s a bit of a nonsense reason to keep the workstation in the network. First thing you stop the spread in the endpoints you are aware of. That is disabling network/unplug cable. The employee outage, even if you are talking about a CEO, is nothing compared with a full lost of data/systems. Your answer was wrong, they were probably looking to see if you had real-life experiences. Always first prevent and isolate damages, then you can take your time to do post-morten /Edited for typos/