According to the CompTIA Cybersecurity Analyst (CySA+) Certification Exam Objectives1, one of the skills required for the exam is to "apply incident response procedures and analyze potential indicators of compromise (IOCs)". The document also states that "the first step in incident response is to contain the incident and prevent further damage" (page 14).
Based on this information, the best answer to your question is C. Remove the malware from the host. This would prevent the malware from spreading to other machines or exfiltrating data from the infected host.