You are monitoring the network of your organizations. You notice that: There are huge outbound connections from your Internal Network to External IPs On further investigation, you see that the…

Blocking blacklisted IPs at the firewall is a reactive, partial measure; the malware persists on internal hosts and can use new or unlisted C2 addresses, leaving the environment still compromised.

Updating IDS/IPS signatures alone improves detection but does not remove existing malware already running on infected endpoints.

Cleaning malware removes the infection but without updated signatures, new or similar malware samples may go undetected and re-infect the environment.

Simply blocking blacklisted IPs at the firewall (option A) is insufficient because it treats only the symptom - the malware remains on internal hosts and can switch to new C2 infrastructure. Cleaning the malware (C) removes the root cause from infected machines, while updating IDS/IPS signatures (B) improves detection and blocking of known C2 patterns and variants at the network level. Together, B and C provide both remediation and improved defensive coverage, making D the complete and correct answer.