A responder finds active malware on a server containing volatile evidence. What should guide the next action?

1. The response plan, safety, containment needs and evidence value
2. Collect every possible artifact before considering harm
3. Always power off instantly regardless of context
4. Always leave the server connected indefinitely