Which of the following should be the FIRST step when performing triage of a malware incident?

Preserving the forensic image is important for investigation and recovery but comes after containment, as the system must first be isolated to prevent further compromise before imaging.

Containing the affected system is the immediate priority in an incident response plan to prevent the malware from spreading to other systems or exfiltrating data, thereby limiting the scope and impact of the incident. This step helps stabilize the environment before further investigation or remediation.

Comparing backup against production is a recovery and analysis step that occurs later in the incident response lifecycle, typically after containment and eradication.

Removing the malware is an eradication step, which is performed after containment and proper analysis to ensure complete removal and prevent recurrence.