During incident response, the team discovers that an attacker used a scheduled task to maintain persistence. After removing the scheduled task, what additional recovery step is necessary to ensure persistence is fully eliminated?

B is correct because sophisticated attackers install multiple redundant persistence mechanisms; removing only the discovered scheduled task while leaving other backdoors (startup entries, malicious services, web shells, modified binaries) means the attacker retains access. A is wrong because rebooting removes volatile artifacts but does not address persistent mechanisms that survive reboots. C is wrong because changing the hostname does not affect the attacker's ability to reconnect using stored credentials or persistence mechanisms. D is wrong because permanently disabling Task Scheduler impacts legitimate system operations and maintenance; the correct action is to remove malicious tasks, not disable the entire service.