During a Monthly Vulnerability Scan, a Server Was Flagged for Being

During a monthly vulnerability scan, a server was flagged for being vulnerable to an Apache Struts exploit. Upon further investigation, the developer responsible for the server informs the security team that Apache Struts is not installed on the server. Which of the following BEST describes how the security team should reach to this incident?

A) The finding is a false positive and can be disregarded
B) The Struts module needs to be hardened on the server
C) The Apache software on the server needs to be patched and updated
D) The server has been compromised by malware and needs to be quarantined.