A vulnerability scan reports an affected product, but the host has a backported fix. What should the analyst do?

1. Validate the installed vendor build and patch evidence
2. Ignore every result from this scanner permanently
3. Exploit the production host without authorization
4. Remove the server's inventory record