In which scenario would it be beneficial for an organization to eradicate a threat from...

The Incident Response team is identifying the scope of the infection and is gathering a list of infected systems.

The Incident Response team is reviewing detections in the risk logs and assigning a High-Security Antivirus and Antispyware policy in the Symantec Endpoint Protection Manager (SEPM).

The Incident Response team completed their analysis of the threat and added it to a blacklist.

The Incident Response team is analyzing the file to determine if it is a threat or a false positive.