A critical server was compromised by malware, and all functionality was lost. Backups of this server were taken; however, management believes a logic bomb may have been injected by a rootkit. Which of the following should a security analyst perform to restore functionality quickly?
A) Work backward, restoring each backup until the server is clean
B) Restore the previous backup and scan with a live boot anti-malware scanner
C) Stand up a new server and restore critical data from backups
D) Offload the critical data to a new server and continue operations

Question

Quizplus · Accepted Answer

Standing up a new server and restoring critical data from backups ensures that the server is free from any potential logic bombs or rootkits, providing a clean and secure environment.

A Critical Server Was Compromised by Malware, and All Functionality