A company's IRP prioritises containment over elimination. An incident has been discovered in which an intruder from outside the organisation configured cryptocurrency mining software on the organization's web servers. What next step should the organization take?

SELECT THE CORRECT ANSWER

Decommission the affected servers from the network.

Examine firewall and intrusion detection system logs for possible source IPs.

Locate and install any missing software updates.

Remove the malicious software and determine whether the servers need to be reimaged.