Which of the following describes the reason root cause analysis should be conducted as part of incident response?

Root cause analysis (RCA) is performed to identify the fundamental reason an incident occurred, not just the symptoms. By understanding the root cause, an organization can implement corrective actions to prevent similar incidents from happening again, thereby improving overall security posture. While gathering Indicators of Compromise (IoCs) and discovering affected systems are crucial steps in the incident response process, they are part of the initial investigation and containment phases, not the primary goal of RCA. Eradicating malware is also a containment and recovery step, focusing on the immediate threat rather than the underlying cause that allowed the malware to enter or execute.